# Flog Txt Version 1
# Analyzer Version: 4.3.0
# Analyzer Build Date: Sep 20 2021 05:59:55
# Log Creation Date: 27.09.2021 14:15:39.174

Process:
	id = "1"
	image_name = "85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	filename = "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	page_root = "0x3e92e000"
	os_pid = "0xf44"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x45c"
	cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe\" "
	cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\"
	os_username = "Q9IATRKPRH\\kEecfMwgj"
	bitness = "32"
	os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 117
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 118
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 119
	        start_va = 0x40000
	          end_va = 0x40fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 120
	        start_va = 0x50000
	          end_va = 0x53fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 121
	        start_va = 0x60000
	          end_va = 0x60fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 122
	        start_va = 0x120000
	          end_va = 0x1fbfff
	       monitored = 1
	     entry_point = 0x1dfcf2
	     region_type = mapped_file
	            name = "85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	        filename = "\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")

Region:
	              id = 123
	        start_va = 0x300000
	          end_va = 0x33ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000300000"
	        filename = ""

Region:
	              id = 124
	        start_va = 0x470000
	          end_va = 0x56ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000470000"
	        filename = ""

Region:
	              id = 125
	        start_va = 0x776e0000
	          end_va = 0x77888fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 126
	        start_va = 0x778c0000
	          end_va = 0x77a3ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 127
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 128
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 129
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 130
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 131
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 132
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 133
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 272
	        start_va = 0x750000
	          end_va = 0x7cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000750000"
	        filename = ""

Region:
	              id = 273
	        start_va = 0x75130000
	          end_va = 0x75137fff
	       monitored = 0
	     entry_point = 0x751320f8
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 274
	        start_va = 0x75140000
	          end_va = 0x7519bfff
	       monitored = 0
	     entry_point = 0x7517f9f4
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 275
	        start_va = 0x751a0000
	          end_va = 0x751defff
	       monitored = 0
	     entry_point = 0x751ce088
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 276
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 0
	     entry_point = 0x774d5340
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 277
	        start_va = 0x772b0000
	          end_va = 0x773bffff
	       monitored = 0
	     entry_point = 0x772c3283
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 278
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 0
	     entry_point = 0x774d5340
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 279
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000774c0000"
	        filename = ""

Region:
	              id = 280
	        start_va = 0x775e0000
	          end_va = 0x776d9fff
	       monitored = 0
	     entry_point = 0x775fa2c8
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 281
	        start_va = 0x775e0000
	          end_va = 0x776d9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000775e0000"
	        filename = ""

Region:
	              id = 282
	        start_va = 0x7d0000
	          end_va = 0xaaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007d0000"
	        filename = ""

Region:
	              id = 283
	        start_va = 0x752a0000
	          end_va = 0x752e9fff
	       monitored = 1
	     entry_point = 0x752a2e54
	     region_type = mapped_file
	            name = "mscoree.dll"
	        filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")

Region:
	              id = 284
	        start_va = 0x772b0000
	          end_va = 0x773bffff
	       monitored = 0
	     entry_point = 0x772c3283
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 285
	        start_va = 0x773e0000
	          end_va = 0x77426fff
	       monitored = 0
	     entry_point = 0x773e74c1
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 286
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 287
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 288
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 289
	        start_va = 0x70000
	          end_va = 0xd6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 290
	        start_va = 0x570000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 291
	        start_va = 0x200000
	          end_va = 0x26ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 292
	        start_va = 0x77180000
	          end_va = 0x7721ffff
	       monitored = 0
	     entry_point = 0x771949e5
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 293
	        start_va = 0x76b90000
	          end_va = 0x76c3bfff
	       monitored = 0
	     entry_point = 0x76b9a472
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 294
	        start_va = 0x77490000
	          end_va = 0x774a8fff
	       monitored = 0
	     entry_point = 0x77494975
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 295
	        start_va = 0x769e0000
	          end_va = 0x76acffff
	       monitored = 0
	     entry_point = 0x769f0569
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 296
	        start_va = 0x75410000
	          end_va = 0x7546ffff
	       monitored = 0
	     entry_point = 0x7542a3b3
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 297
	        start_va = 0x75400000
	          end_va = 0x7540bfff
	       monitored = 0
	     entry_point = 0x754010e1
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 298
	        start_va = 0x340000
	          end_va = 0x40ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000340000"
	        filename = ""

Region:
	              id = 299
	        start_va = 0x75210000
	          end_va = 0x7529cfff
	       monitored = 1
	     entry_point = 0x75222860
	     region_type = mapped_file
	            name = "mscoreei.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")

Region:
	              id = 300
	        start_va = 0x73430000
	          end_va = 0x73432fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "api-ms-win-core-synch-l1-2-0.dll"
	        filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll")

Region:
	              id = 301
	        start_va = 0x76850000
	          end_va = 0x768a6fff
	       monitored = 0
	     entry_point = 0x76869ba6
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 302
	        start_va = 0x76270000
	          end_va = 0x762fffff
	       monitored = 0
	     entry_point = 0x76286343
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 303
	        start_va = 0x766d0000
	          end_va = 0x767cffff
	       monitored = 0
	     entry_point = 0x766eb6ed
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 304
	        start_va = 0x77890000
	          end_va = 0x77899fff
	       monitored = 0
	     entry_point = 0x778936a0
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 305
	        start_va = 0x76300000
	          end_va = 0x7639cfff
	       monitored = 0
	     entry_point = 0x76333fd7
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 306
	        start_va = 0x20000
	          end_va = 0x3dfff
	       monitored = 0
	     entry_point = 0x3158f
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 307
	        start_va = 0x7d0000
	          end_va = 0x957fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007d0000"
	        filename = ""

Region:
	              id = 308
	        start_va = 0x9b0000
	          end_va = 0xaaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000009b0000"
	        filename = ""

Region:
	              id = 309
	        start_va = 0x20000
	          end_va = 0x3dfff
	       monitored = 0
	     entry_point = 0x3158f
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 310
	        start_va = 0x77430000
	          end_va = 0x7748ffff
	       monitored = 0
	     entry_point = 0x7744158f
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 311
	        start_va = 0x77050000
	          end_va = 0x7711bfff
	       monitored = 0
	     entry_point = 0x7705168b
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 312
	        start_va = 0x20000
	          end_va = 0x20fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 313
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 314
	        start_va = 0xab0000
	          end_va = 0xc30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ab0000"
	        filename = ""

Region:
	              id = 315
	        start_va = 0xc40000
	          end_va = 0x203ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c40000"
	        filename = ""

Region:
	              id = 316
	        start_va = 0x570000
	          end_va = 0x647fff
	       monitored = 1
	     entry_point = 0x62fcf2
	     region_type = mapped_file
	            name = "85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	        filename = "\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")

Region:
	              id = 317
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 318
	        start_va = 0x570000
	          end_va = 0x647fff
	       monitored = 1
	     entry_point = 0x62fcf2
	     region_type = mapped_file
	            name = "85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	        filename = "\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")

Region:
	              id = 319
	        start_va = 0x74400000
	          end_va = 0x74408fff
	       monitored = 0
	     entry_point = 0x74401220
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 320
	        start_va = 0x723c0000
	          end_va = 0x72b6efff
	       monitored = 1
	     entry_point = 0x723dd0d0
	     region_type = mapped_file
	            name = "clr.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")

Region:
	              id = 321
	        start_va = 0x71c10000
	          end_va = 0x723befff
	       monitored = 1
	     entry_point = 0x71c2d0d0
	     region_type = mapped_file
	            name = "clr.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")

Region:
	              id = 322
	        start_va = 0x723c0000
	          end_va = 0x72b6efff
	       monitored = 1
	     entry_point = 0x723dd0d0
	     region_type = mapped_file
	            name = "clr.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")

Region:
	              id = 323
	        start_va = 0x751f0000
	          end_va = 0x75203fff
	       monitored = 0
	     entry_point = 0x751fac00
	     region_type = mapped_file
	            name = "vcruntime140_clr0400.dll"
	        filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll")

Region:
	              id = 324
	        start_va = 0x72310000
	          end_va = 0x723bafff
	       monitored = 0
	     entry_point = 0x723a5f20
	     region_type = mapped_file
	            name = "ucrtbase_clr0400.dll"
	        filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll")

Region:
	              id = 325
	        start_va = 0xe0000
	          end_va = 0xe0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 326
	        start_va = 0xf0000
	          end_va = 0xfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 327
	        start_va = 0x100000
	          end_va = 0x10ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 328
	        start_va = 0x110000
	          end_va = 0x11ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 329
	        start_va = 0x200000
	          end_va = 0x20ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 330
	        start_va = 0x230000
	          end_va = 0x26ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 331
	        start_va = 0x210000
	          end_va = 0x21ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000210000"
	        filename = ""

Region:
	              id = 332
	        start_va = 0x220000
	          end_va = 0x22ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000220000"
	        filename = ""

Region:
	              id = 333
	        start_va = 0x270000
	          end_va = 0x270fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000270000"
	        filename = ""

Region:
	              id = 334
	        start_va = 0x280000
	          end_va = 0x280fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000280000"
	        filename = ""

Region:
	              id = 335
	        start_va = 0x290000
	          end_va = 0x2effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000290000"
	        filename = ""

Region:
	              id = 336
	        start_va = 0x2040000
	          end_va = 0x223ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002040000"
	        filename = ""

Region:
	              id = 337
	        start_va = 0x380000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000380000"
	        filename = ""

Region:
	              id = 338
	        start_va = 0x400000
	          end_va = 0x40ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 339
	        start_va = 0x590000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 340
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 341
	        start_va = 0x290000
	          end_va = 0x29ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000290000"
	        filename = ""

Region:
	              id = 342
	        start_va = 0x2b0000
	          end_va = 0x2effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002b0000"
	        filename = ""

Region:
	              id = 343
	        start_va = 0x2240000
	          end_va = 0x423ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002240000"
	        filename = ""

Region:
	              id = 344
	        start_va = 0x2040000
	          end_va = 0x20dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002040000"
	        filename = ""

Region:
	              id = 345
	        start_va = 0x2200000
	          end_va = 0x223ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002200000"
	        filename = ""

Region:
	              id = 346
	        start_va = 0x410000
	          end_va = 0x44ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000410000"
	        filename = ""

Region:
	              id = 347
	        start_va = 0x4330000
	          end_va = 0x442ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004330000"
	        filename = ""

Region:
	              id = 348
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 349
	        start_va = 0x6f0000
	          end_va = 0x72ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 350
	        start_va = 0x45c0000
	          end_va = 0x46bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045c0000"
	        filename = ""

Region:
	              id = 351
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 352
	        start_va = 0x46c0000
	          end_va = 0x498efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 353
	        start_va = 0x70f00000
	          end_va = 0x7230afff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mscorlib.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll")

Region:
	              id = 354
	        start_va = 0x763d0000
	          end_va = 0x7652bfff
	       monitored = 0
	     entry_point = 0x7641ba3d
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 355
	        start_va = 0x74320000
	          end_va = 0x7439ffff
	       monitored = 0
	     entry_point = 0x743337c9
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 356
	        start_va = 0x4990000
	          end_va = 0x4b7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004990000"
	        filename = ""

Region:
	              id = 357
	        start_va = 0x20e0000
	          end_va = 0x21befff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000020e0000"
	        filename = ""

Region:
	              id = 358
	        start_va = 0x290000
	          end_va = 0x29ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000290000"
	        filename = ""

Region:
	              id = 359
	        start_va = 0x2a0000
	          end_va = 0x2affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002a0000"
	        filename = ""

Region:
	              id = 360
	        start_va = 0x751e0000
	          end_va = 0x751e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "api-ms-win-core-xstate-l2-1-0.dll"
	        filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll")

Region:
	              id = 361
	        start_va = 0x70e70000
	          end_va = 0x70ef8fff
	       monitored = 1
	     entry_point = 0x70e71130
	     region_type = mapped_file
	            name = "clrjit.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")

Region:
	              id = 362
	        start_va = 0x76ad0000
	          end_va = 0x76b5efff
	       monitored = 0
	     entry_point = 0x76ad3fb1
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 363
	        start_va = 0x2f0000
	          end_va = 0x2fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002f0000"
	        filename = ""

Region:
	              id = 364
	        start_va = 0x70410000
	          end_va = 0x70e64fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll")

Region:
	              id = 365
	        start_va = 0x701d0000
	          end_va = 0x70372fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.drawing.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\system.drawing.ni.dll")

Region:
	              id = 366
	        start_va = 0x6f360000
	          end_va = 0x701c5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.windows.forms.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\system.windows.forms.ni.dll")

Region:
	              id = 367
	        start_va = 0x6edb0000
	          end_va = 0x6f353fff
	       monitored = 1
	     entry_point = 0x6f33b692
	     region_type = mapped_file
	            name = "system.windows.forms.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll")

Region:
	              id = 368
	        start_va = 0x340000
	          end_va = 0x341fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000340000"
	        filename = ""

Region:
	              id = 369
	        start_va = 0x6eb40000
	          end_va = 0x6f357fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.core.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll")

Region:
	              id = 370
	        start_va = 0x6ea30000
	          end_va = 0x6eb34fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.configuration.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll")

Region:
	              id = 371
	        start_va = 0x6e2b0000
	          end_va = 0x6ea23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.xml.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll")

Region:
	              id = 372
	        start_va = 0x6e290000
	          end_va = 0x6e2a2fff
	       monitored = 1
	     entry_point = 0x6e29d900
	     region_type = mapped_file
	            name = "nlssorting.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")

Region:
	              id = 373
	        start_va = 0x4b80000
	          end_va = 0x4e51fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nlp"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp")

Region:
	              id = 374
	        start_va = 0x755b0000
	          end_va = 0x761f9fff
	       monitored = 0
	     entry_point = 0x75631601
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 375
	        start_va = 0x350000
	          end_va = 0x350fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000350000"
	        filename = ""

Region:
	              id = 376
	        start_va = 0x744c0000
	          end_va = 0x744cafff
	       monitored = 0
	     entry_point = 0x744c1992
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 377
	        start_va = 0x4e60000
	          end_va = 0x505ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e60000"
	        filename = ""

Region:
	              id = 378
	        start_va = 0x6e270000
	          end_va = 0x6e286fff
	       monitored = 0
	     entry_point = 0x6e2735fa
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 379
	        start_va = 0x74190000
	          end_va = 0x741a6fff
	       monitored = 0
	     entry_point = 0x74193573
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 380
	        start_va = 0x3c0000
	          end_va = 0x3fbfff
	       monitored = 0
	     entry_point = 0x3c128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 381
	        start_va = 0x3c0000
	          end_va = 0x3fbfff
	       monitored = 0
	     entry_point = 0x3c128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 382
	        start_va = 0x3c0000
	          end_va = 0x3fbfff
	       monitored = 0
	     entry_point = 0x3c128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 383
	        start_va = 0x3c0000
	          end_va = 0x3fbfff
	       monitored = 0
	     entry_point = 0x3c128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 384
	        start_va = 0x3c0000
	          end_va = 0x3fbfff
	       monitored = 0
	     entry_point = 0x3c128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 385
	        start_va = 0x74150000
	          end_va = 0x7418afff
	       monitored = 0
	     entry_point = 0x7415128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 386
	        start_va = 0x4240000
	          end_va = 0x42c1fff
	       monitored = 0
	     entry_point = 0x42419a9
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 387
	        start_va = 0x4240000
	          end_va = 0x42c1fff
	       monitored = 0
	     entry_point = 0x42419a9
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 388
	        start_va = 0x6e1e0000
	          end_va = 0x6e263fff
	       monitored = 0
	     entry_point = 0x6e1e19a9
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 389
	        start_va = 0x4e60000
	          end_va = 0x501ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e60000"
	        filename = ""

Region:
	              id = 390
	        start_va = 0x5020000
	          end_va = 0x505ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005020000"
	        filename = ""

Region:
	              id = 391
	        start_va = 0x360000
	          end_va = 0x36ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000360000"
	        filename = ""

Region:
	              id = 392
	        start_va = 0x360000
	          end_va = 0x36ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000360000"
	        filename = ""

Region:
	              id = 393
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000370000"
	        filename = ""

Region:
	              id = 394
	        start_va = 0x3c0000
	          end_va = 0x3cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003c0000"
	        filename = ""

Region:
	              id = 395
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 396
	        start_va = 0x3e0000
	          end_va = 0x3effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 397
	        start_va = 0x3f0000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003f0000"
	        filename = ""

Region:
	              id = 398
	        start_va = 0x450000
	          end_va = 0x45ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 399
	        start_va = 0x460000
	          end_va = 0x46ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 400
	        start_va = 0x570000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 401
	        start_va = 0x580000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 402
	        start_va = 0x690000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 403
	        start_va = 0x6a0000
	          end_va = 0x6affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006a0000"
	        filename = ""

Region:
	              id = 404
	        start_va = 0x6b0000
	          end_va = 0x6bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006b0000"
	        filename = ""

Region:
	              id = 405
	        start_va = 0x6c0000
	          end_va = 0x6cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006c0000"
	        filename = ""

Region:
	              id = 406
	        start_va = 0x6d0000
	          end_va = 0x6dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006d0000"
	        filename = ""

Region:
	              id = 407
	        start_va = 0x6e050000
	          end_va = 0x6e1dffff
	       monitored = 0
	     entry_point = 0x6e0ed026
	     region_type = mapped_file
	            name = "gdiplus.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll")

Region:
	              id = 408
	        start_va = 0x4430000
	          end_va = 0x456ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004430000"
	        filename = ""

Region:
	              id = 409
	        start_va = 0x4430000
	          end_va = 0x446ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004430000"
	        filename = ""

Region:
	              id = 410
	        start_va = 0x4560000
	          end_va = 0x456ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004560000"
	        filename = ""

Region:
	              id = 411
	        start_va = 0x4e80000
	          end_va = 0x4f7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e80000"
	        filename = ""

Region:
	              id = 412
	        start_va = 0x5010000
	          end_va = 0x501ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005010000"
	        filename = ""

Region:
	              id = 413
	        start_va = 0x70400000
	          end_va = 0x70404fff
	       monitored = 0
	     entry_point = 0x704011d0
	     region_type = mapped_file
	            name = "shfolder.dll"
	        filename = "\\Windows\\SysWOW64\\shfolder.dll" (normalized: "c:\\windows\\syswow64\\shfolder.dll")

Region:
	              id = 414
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 415
	        start_va = 0x360000
	          end_va = 0x362fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gdipfontcachev1.dat"
	        filename = "\\Users\\kEecfMwgj\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\gdipfontcachev1.dat")

Region:
	              id = 416
	        start_va = 0x370000
	          end_va = 0x376fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "marlett.ttf"
	        filename = "\\Windows\\Fonts\\marlett.ttf" (normalized: "c:\\windows\\fonts\\marlett.ttf")

Region:
	              id = 417
	        start_va = 0x370000
	          end_va = 0x376fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "marlett.ttf"
	        filename = "\\Windows\\Fonts\\marlett.ttf" (normalized: "c:\\windows\\fonts\\marlett.ttf")

Region:
	              id = 418
	        start_va = 0x4240000
	          end_va = 0x42fcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arial.ttf"
	        filename = "\\Windows\\Fonts\\arial.ttf" (normalized: "c:\\windows\\fonts\\arial.ttf")

Region:
	              id = 419
	        start_va = 0x4240000
	          end_va = 0x42fcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arial.ttf"
	        filename = "\\Windows\\Fonts\\arial.ttf" (normalized: "c:\\windows\\fonts\\arial.ttf")

Region:
	              id = 420
	        start_va = 0x4990000
	          end_va = 0x4a8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004990000"
	        filename = ""

Region:
	              id = 421
	        start_va = 0x4b40000
	          end_va = 0x4b7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b40000"
	        filename = ""

Region:
	              id = 422
	        start_va = 0x4240000
	          end_va = 0x42c7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ariali.ttf"
	        filename = "\\Windows\\Fonts\\ariali.ttf" (normalized: "c:\\windows\\fonts\\ariali.ttf")

Region:
	              id = 423
	        start_va = 0x4240000
	          end_va = 0x42c7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ariali.ttf"
	        filename = "\\Windows\\Fonts\\ariali.ttf" (normalized: "c:\\windows\\fonts\\ariali.ttf")

Region:
	              id = 424
	        start_va = 0x4240000
	          end_va = 0x42f6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialbd.ttf"
	        filename = "\\Windows\\Fonts\\arialbd.ttf" (normalized: "c:\\windows\\fonts\\arialbd.ttf")

Region:
	              id = 425
	        start_va = 0x4240000
	          end_va = 0x42f6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialbd.ttf"
	        filename = "\\Windows\\Fonts\\arialbd.ttf" (normalized: "c:\\windows\\fonts\\arialbd.ttf")

Region:
	              id = 426
	        start_va = 0x4240000
	          end_va = 0x42c9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialbi.ttf"
	        filename = "\\Windows\\Fonts\\arialbi.ttf" (normalized: "c:\\windows\\fonts\\arialbi.ttf")

Region:
	              id = 427
	        start_va = 0x4240000
	          end_va = 0x42c9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialbi.ttf"
	        filename = "\\Windows\\Fonts\\arialbi.ttf" (normalized: "c:\\windows\\fonts\\arialbi.ttf")

Region:
	              id = 428
	        start_va = 0x5060000
	          end_va = 0x5fe2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "batang.ttc"
	        filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc")

Region:
	              id = 429
	        start_va = 0x5060000
	          end_va = 0x5fe2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "batang.ttc"
	        filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc")

Region:
	              id = 430
	        start_va = 0x5060000
	          end_va = 0x5fe2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "batang.ttc"
	        filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc")

Region:
	              id = 431
	        start_va = 0x5ff0000
	          end_va = 0x61effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ff0000"
	        filename = ""

Region:
	              id = 432
	        start_va = 0x5060000
	          end_va = 0x5fe2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "batang.ttc"
	        filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc")

Region:
	              id = 433
	        start_va = 0x5060000
	          end_va = 0x5fe2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "batang.ttc"
	        filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc")

Region:
	              id = 434
	        start_va = 0x4240000
	          end_va = 0x42edfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cour.ttf"
	        filename = "\\Windows\\Fonts\\cour.ttf" (normalized: "c:\\windows\\fonts\\cour.ttf")

Region:
	              id = 435
	        start_va = 0x4240000
	          end_va = 0x42edfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cour.ttf"
	        filename = "\\Windows\\Fonts\\cour.ttf" (normalized: "c:\\windows\\fonts\\cour.ttf")

Region:
	              id = 436
	        start_va = 0x4240000
	          end_va = 0x42d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "couri.ttf"
	        filename = "\\Windows\\Fonts\\couri.ttf" (normalized: "c:\\windows\\fonts\\couri.ttf")

Region:
	              id = 437
	        start_va = 0x4240000
	          end_va = 0x42d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "couri.ttf"
	        filename = "\\Windows\\Fonts\\couri.ttf" (normalized: "c:\\windows\\fonts\\couri.ttf")

Region:
	              id = 438
	        start_va = 0x4240000
	          end_va = 0x42edfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "courbd.ttf"
	        filename = "\\Windows\\Fonts\\courbd.ttf" (normalized: "c:\\windows\\fonts\\courbd.ttf")

Region:
	              id = 439
	        start_va = 0x4240000
	          end_va = 0x42edfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "courbd.ttf"
	        filename = "\\Windows\\Fonts\\courbd.ttf" (normalized: "c:\\windows\\fonts\\courbd.ttf")

Region:
	              id = 440
	        start_va = 0x4240000
	          end_va = 0x42c1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "courbi.ttf"
	        filename = "\\Windows\\Fonts\\courbi.ttf" (normalized: "c:\\windows\\fonts\\courbi.ttf")

Region:
	              id = 441
	        start_va = 0x4240000
	          end_va = 0x42c1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "courbi.ttf"
	        filename = "\\Windows\\Fonts\\courbi.ttf" (normalized: "c:\\windows\\fonts\\courbi.ttf")

Region:
	              id = 442
	        start_va = 0x3c0000
	          end_va = 0x3eefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "daunpenh.ttf"
	        filename = "\\Windows\\Fonts\\daunpenh.ttf" (normalized: "c:\\windows\\fonts\\daunpenh.ttf")

Region:
	              id = 443
	        start_va = 0x3c0000
	          end_va = 0x3eefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "daunpenh.ttf"
	        filename = "\\Windows\\Fonts\\daunpenh.ttf" (normalized: "c:\\windows\\fonts\\daunpenh.ttf")

Region:
	              id = 444
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "dokchamp.ttf"
	        filename = "\\Windows\\Fonts\\dokchamp.ttf" (normalized: "c:\\windows\\fonts\\dokchamp.ttf")

Region:
	              id = 445
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "dokchamp.ttf"
	        filename = "\\Windows\\Fonts\\dokchamp.ttf" (normalized: "c:\\windows\\fonts\\dokchamp.ttf")

Region:
	              id = 446
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "estre.ttf"
	        filename = "\\Windows\\Fonts\\estre.ttf" (normalized: "c:\\windows\\fonts\\estre.ttf")

Region:
	              id = 447
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "estre.ttf"
	        filename = "\\Windows\\Fonts\\estre.ttf" (normalized: "c:\\windows\\fonts\\estre.ttf")

Region:
	              id = 448
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "euphemia.ttf"
	        filename = "\\Windows\\Fonts\\euphemia.ttf" (normalized: "c:\\windows\\fonts\\euphemia.ttf")

Region:
	              id = 449
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "euphemia.ttf"
	        filename = "\\Windows\\Fonts\\euphemia.ttf" (normalized: "c:\\windows\\fonts\\euphemia.ttf")

Region:
	              id = 450
	        start_va = 0x3c0000
	          end_va = 0x3fefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gautami.ttf"
	        filename = "\\Windows\\Fonts\\gautami.ttf" (normalized: "c:\\windows\\fonts\\gautami.ttf")

Region:
	              id = 451
	        start_va = 0x3c0000
	          end_va = 0x3fefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gautami.ttf"
	        filename = "\\Windows\\Fonts\\gautami.ttf" (normalized: "c:\\windows\\fonts\\gautami.ttf")

Region:
	              id = 452
	        start_va = 0x3c0000
	          end_va = 0x3f6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gautamib.ttf"
	        filename = "\\Windows\\Fonts\\gautamib.ttf" (normalized: "c:\\windows\\fonts\\gautamib.ttf")

Region:
	              id = 453
	        start_va = 0x3c0000
	          end_va = 0x3f6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gautamib.ttf"
	        filename = "\\Windows\\Fonts\\gautamib.ttf" (normalized: "c:\\windows\\fonts\\gautamib.ttf")

Region:
	              id = 454
	        start_va = 0x4240000
	          end_va = 0x429efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vani.ttf"
	        filename = "\\Windows\\Fonts\\Vani.ttf" (normalized: "c:\\windows\\fonts\\vani.ttf")

Region:
	              id = 455
	        start_va = 0x4240000
	          end_va = 0x429efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vani.ttf"
	        filename = "\\Windows\\Fonts\\Vani.ttf" (normalized: "c:\\windows\\fonts\\vani.ttf")

Region:
	              id = 456
	        start_va = 0x4240000
	          end_va = 0x429afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vanib.ttf"
	        filename = "\\Windows\\Fonts\\Vanib.ttf" (normalized: "c:\\windows\\fonts\\vanib.ttf")

Region:
	              id = 457
	        start_va = 0x4240000
	          end_va = 0x429afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vanib.ttf"
	        filename = "\\Windows\\Fonts\\Vanib.ttf" (normalized: "c:\\windows\\fonts\\vanib.ttf")

Region:
	              id = 458
	        start_va = 0x5060000
	          end_va = 0x5d45fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gulim.ttc"
	        filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc")

Region:
	              id = 459
	        start_va = 0x5060000
	          end_va = 0x5d45fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gulim.ttc"
	        filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc")

Region:
	              id = 460
	        start_va = 0x5060000
	          end_va = 0x5d45fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gulim.ttc"
	        filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc")

Region:
	              id = 461
	        start_va = 0x5060000
	          end_va = 0x5d45fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gulim.ttc"
	        filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc")

Region:
	              id = 462
	        start_va = 0x61f0000
	          end_va = 0x65effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000061f0000"
	        filename = ""

Region:
	              id = 463
	        start_va = 0x5060000
	          end_va = 0x5d45fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gulim.ttc"
	        filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc")

Region:
	              id = 464
	        start_va = 0x3c0000
	          end_va = 0x3e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "impact.ttf"
	        filename = "\\Windows\\Fonts\\impact.ttf" (normalized: "c:\\windows\\fonts\\impact.ttf")

Region:
	              id = 465
	        start_va = 0x3c0000
	          end_va = 0x3e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "impact.ttf"
	        filename = "\\Windows\\Fonts\\impact.ttf" (normalized: "c:\\windows\\fonts\\impact.ttf")

Region:
	              id = 466
	        start_va = 0x4240000
	          end_va = 0x42c5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "iskpota.ttf"
	        filename = "\\Windows\\Fonts\\iskpota.ttf" (normalized: "c:\\windows\\fonts\\iskpota.ttf")

Region:
	              id = 467
	        start_va = 0x4240000
	          end_va = 0x42c5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "iskpota.ttf"
	        filename = "\\Windows\\Fonts\\iskpota.ttf" (normalized: "c:\\windows\\fonts\\iskpota.ttf")

Region:
	              id = 468
	        start_va = 0x4240000
	          end_va = 0x429afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "iskpotab.ttf"
	        filename = "\\Windows\\Fonts\\iskpotab.ttf" (normalized: "c:\\windows\\fonts\\iskpotab.ttf")

Region:
	              id = 469
	        start_va = 0x4240000
	          end_va = 0x429afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "iskpotab.ttf"
	        filename = "\\Windows\\Fonts\\iskpotab.ttf" (normalized: "c:\\windows\\fonts\\iskpotab.ttf")

Region:
	              id = 470
	        start_va = 0x3c0000
	          end_va = 0x3f3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kalinga.ttf"
	        filename = "\\Windows\\Fonts\\kalinga.ttf" (normalized: "c:\\windows\\fonts\\kalinga.ttf")

Region:
	              id = 471
	        start_va = 0x3c0000
	          end_va = 0x3f3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kalinga.ttf"
	        filename = "\\Windows\\Fonts\\kalinga.ttf" (normalized: "c:\\windows\\fonts\\kalinga.ttf")

Region:
	              id = 472
	        start_va = 0x3c0000
	          end_va = 0x3f2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kalingab.ttf"
	        filename = "\\Windows\\Fonts\\kalingab.ttf" (normalized: "c:\\windows\\fonts\\kalingab.ttf")

Region:
	              id = 473
	        start_va = 0x3c0000
	          end_va = 0x3f2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kalingab.ttf"
	        filename = "\\Windows\\Fonts\\kalingab.ttf" (normalized: "c:\\windows\\fonts\\kalingab.ttf")

Region:
	              id = 474
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kartika.ttf"
	        filename = "\\Windows\\Fonts\\kartika.ttf" (normalized: "c:\\windows\\fonts\\kartika.ttf")

Region:
	              id = 475
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kartika.ttf"
	        filename = "\\Windows\\Fonts\\kartika.ttf" (normalized: "c:\\windows\\fonts\\kartika.ttf")

Region:
	              id = 476
	        start_va = 0x3c0000
	          end_va = 0x3defff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kartikab.ttf"
	        filename = "\\Windows\\Fonts\\kartikab.ttf" (normalized: "c:\\windows\\fonts\\kartikab.ttf")

Region:
	              id = 477
	        start_va = 0x3c0000
	          end_va = 0x3defff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kartikab.ttf"
	        filename = "\\Windows\\Fonts\\kartikab.ttf" (normalized: "c:\\windows\\fonts\\kartikab.ttf")

Region:
	              id = 478
	        start_va = 0x4240000
	          end_va = 0x4290fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "khmerui.ttf"
	        filename = "\\Windows\\Fonts\\KhmerUI.ttf" (normalized: "c:\\windows\\fonts\\khmerui.ttf")

Region:
	              id = 479
	        start_va = 0x4240000
	          end_va = 0x4290fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "khmerui.ttf"
	        filename = "\\Windows\\Fonts\\KhmerUI.ttf" (normalized: "c:\\windows\\fonts\\khmerui.ttf")

Region:
	              id = 480
	        start_va = 0x690000
	          end_va = 0x6d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "khmeruib.ttf"
	        filename = "\\Windows\\Fonts\\KhmerUIb.ttf" (normalized: "c:\\windows\\fonts\\khmeruib.ttf")

Region:
	              id = 481
	        start_va = 0x690000
	          end_va = 0x6d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "khmeruib.ttf"
	        filename = "\\Windows\\Fonts\\KhmerUIb.ttf" (normalized: "c:\\windows\\fonts\\khmeruib.ttf")

Region:
	              id = 482
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "laoui.ttf"
	        filename = "\\Windows\\Fonts\\LaoUI.ttf" (normalized: "c:\\windows\\fonts\\laoui.ttf")

Region:
	              id = 483
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "laoui.ttf"
	        filename = "\\Windows\\Fonts\\LaoUI.ttf" (normalized: "c:\\windows\\fonts\\laoui.ttf")

Region:
	              id = 484
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "laouib.ttf"
	        filename = "\\Windows\\Fonts\\LaoUIb.ttf" (normalized: "c:\\windows\\fonts\\laouib.ttf")

Region:
	              id = 485
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "laouib.ttf"
	        filename = "\\Windows\\Fonts\\LaoUIb.ttf" (normalized: "c:\\windows\\fonts\\laouib.ttf")

Region:
	              id = 486
	        start_va = 0x3c0000
	          end_va = 0x3ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "latha.ttf"
	        filename = "\\Windows\\Fonts\\latha.ttf" (normalized: "c:\\windows\\fonts\\latha.ttf")

Region:
	              id = 487
	        start_va = 0x3c0000
	          end_va = 0x3ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "latha.ttf"
	        filename = "\\Windows\\Fonts\\latha.ttf" (normalized: "c:\\windows\\fonts\\latha.ttf")

Region:
	              id = 488
	        start_va = 0x3c0000
	          end_va = 0x3ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lathab.ttf"
	        filename = "\\Windows\\Fonts\\lathab.ttf" (normalized: "c:\\windows\\fonts\\lathab.ttf")

Region:
	              id = 489
	        start_va = 0x3c0000
	          end_va = 0x3ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lathab.ttf"
	        filename = "\\Windows\\Fonts\\lathab.ttf" (normalized: "c:\\windows\\fonts\\lathab.ttf")

Region:
	              id = 490
	        start_va = 0x3c0000
	          end_va = 0x3dcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lucon.ttf"
	        filename = "\\Windows\\Fonts\\lucon.ttf" (normalized: "c:\\windows\\fonts\\lucon.ttf")

Region:
	              id = 491
	        start_va = 0x3c0000
	          end_va = 0x3dcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lucon.ttf"
	        filename = "\\Windows\\Fonts\\lucon.ttf" (normalized: "c:\\windows\\fonts\\lucon.ttf")

Region:
	              id = 492
	        start_va = 0x5060000
	          end_va = 0x5482fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "malgun.ttf"
	        filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf")

Region:
	              id = 493
	        start_va = 0x5060000
	          end_va = 0x5482fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "malgun.ttf"
	        filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf")

Region:
	              id = 494
	        start_va = 0x5060000
	          end_va = 0x54aefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "malgunbd.ttf"
	        filename = "\\Windows\\Fonts\\malgunbd.ttf" (normalized: "c:\\windows\\fonts\\malgunbd.ttf")

Region:
	              id = 495
	        start_va = 0x5060000
	          end_va = 0x54aefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "malgunbd.ttf"
	        filename = "\\Windows\\Fonts\\malgunbd.ttf" (normalized: "c:\\windows\\fonts\\malgunbd.ttf")

Region:
	              id = 496
	        start_va = 0x3c0000
	          end_va = 0x3f2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mangal.ttf"
	        filename = "\\Windows\\Fonts\\mangal.ttf" (normalized: "c:\\windows\\fonts\\mangal.ttf")

Region:
	              id = 497
	        start_va = 0x3c0000
	          end_va = 0x3f2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mangal.ttf"
	        filename = "\\Windows\\Fonts\\mangal.ttf" (normalized: "c:\\windows\\fonts\\mangal.ttf")

Region:
	              id = 498
	        start_va = 0x3c0000
	          end_va = 0x3eefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mangalb.ttf"
	        filename = "\\Windows\\Fonts\\mangalb.ttf" (normalized: "c:\\windows\\fonts\\mangalb.ttf")

Region:
	              id = 499
	        start_va = 0x3c0000
	          end_va = 0x3eefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mangalb.ttf"
	        filename = "\\Windows\\Fonts\\mangalb.ttf" (normalized: "c:\\windows\\fonts\\mangalb.ttf")

Region:
	              id = 500
	        start_va = 0x5060000
	          end_va = 0x5977fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "meiryo.ttc"
	        filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc")

Region:
	              id = 501
	        start_va = 0x5060000
	          end_va = 0x5977fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "meiryo.ttc"
	        filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc")

Region:
	              id = 502
	        start_va = 0x5060000
	          end_va = 0x5977fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "meiryo.ttc"
	        filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc")

Region:
	              id = 503
	        start_va = 0x5060000
	          end_va = 0x5977fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "meiryo.ttc"
	        filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc")

Region:
	              id = 504
	        start_va = 0x5060000
	          end_va = 0x5977fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "meiryo.ttc"
	        filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc")

Region:
	              id = 505
	        start_va = 0x5060000
	          end_va = 0x59acfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "meiryob.ttc"
	        filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc")

Region:
	              id = 506
	        start_va = 0x5060000
	          end_va = 0x59acfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "meiryob.ttc"
	        filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc")

Region:
	              id = 507
	        start_va = 0x5060000
	          end_va = 0x59acfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "meiryob.ttc"
	        filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc")

Region:
	              id = 508
	        start_va = 0x5060000
	          end_va = 0x59acfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "meiryob.ttc"
	        filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc")

Region:
	              id = 509
	        start_va = 0x5060000
	          end_va = 0x59acfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "meiryob.ttc"
	        filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc")

Region:
	              id = 510
	        start_va = 0x65f0000
	          end_va = 0x6deffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000065f0000"
	        filename = ""

Region:
	              id = 511
	        start_va = 0x4240000
	          end_va = 0x42d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "himalaya.ttf"
	        filename = "\\Windows\\Fonts\\himalaya.ttf" (normalized: "c:\\windows\\fonts\\himalaya.ttf")

Region:
	              id = 512
	        start_va = 0x4240000
	          end_va = 0x42d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "himalaya.ttf"
	        filename = "\\Windows\\Fonts\\himalaya.ttf" (normalized: "c:\\windows\\fonts\\himalaya.ttf")

Region:
	              id = 513
	        start_va = 0x6df0000
	          end_va = 0x8298fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msjh.ttf"
	        filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf")

Region:
	              id = 514
	        start_va = 0x6df0000
	          end_va = 0x8298fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msjh.ttf"
	        filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf")

Region:
	              id = 515
	        start_va = 0x5060000
	          end_va = 0x5e36fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msjhbd.ttf"
	        filename = "\\Windows\\Fonts\\msjhbd.ttf" (normalized: "c:\\windows\\fonts\\msjhbd.ttf")

Region:
	              id = 516
	        start_va = 0x5060000
	          end_va = 0x5e36fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msjhbd.ttf"
	        filename = "\\Windows\\Fonts\\msjhbd.ttf" (normalized: "c:\\windows\\fonts\\msjhbd.ttf")

Region:
	              id = 517
	        start_va = 0x6df0000
	          end_va = 0x82b2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyh.ttf"
	        filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf")

Region:
	              id = 518
	        start_va = 0x6df0000
	          end_va = 0x82b2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyh.ttf"
	        filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf")

Region:
	              id = 519
	        start_va = 0x5060000
	          end_va = 0x5e4dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyhbd.ttf"
	        filename = "\\Windows\\Fonts\\msyhbd.ttf" (normalized: "c:\\windows\\fonts\\msyhbd.ttf")

Region:
	              id = 520
	        start_va = 0x5060000
	          end_va = 0x5e4dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyhbd.ttf"
	        filename = "\\Windows\\Fonts\\msyhbd.ttf" (normalized: "c:\\windows\\fonts\\msyhbd.ttf")

Region:
	              id = 521
	        start_va = 0x6df0000
	          end_va = 0x8ca9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mingliu.ttc"
	        filename = "\\Windows\\Fonts\\mingliu.ttc" (normalized: "c:\\windows\\fonts\\mingliu.ttc")

Region:
	              id = 522
	        start_va = 0x6df0000
	          end_va = 0x8ca9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mingliu.ttc"
	        filename = "\\Windows\\Fonts\\mingliu.ttc" (normalized: "c:\\windows\\fonts\\mingliu.ttc")

Region:
	              id = 523
	        start_va = 0x6df0000
	          end_va = 0x8ca9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mingliu.ttc"
	        filename = "\\Windows\\Fonts\\mingliu.ttc" (normalized: "c:\\windows\\fonts\\mingliu.ttc")

Region:
	              id = 524
	        start_va = 0x6df0000
	          end_va = 0x8ca9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mingliu.ttc"
	        filename = "\\Windows\\Fonts\\mingliu.ttc" (normalized: "c:\\windows\\fonts\\mingliu.ttc")

Region:
	              id = 525
	        start_va = 0x6df0000
	          end_va = 0x8e2dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mingliub.ttc"
	        filename = "\\Windows\\Fonts\\mingliub.ttc" (normalized: "c:\\windows\\fonts\\mingliub.ttc")

Region:
	              id = 526
	        start_va = 0x6df0000
	          end_va = 0x8e2dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mingliub.ttc"
	        filename = "\\Windows\\Fonts\\mingliub.ttc" (normalized: "c:\\windows\\fonts\\mingliub.ttc")

Region:
	              id = 527
	        start_va = 0x6df0000
	          end_va = 0x8e2dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mingliub.ttc"
	        filename = "\\Windows\\Fonts\\mingliub.ttc" (normalized: "c:\\windows\\fonts\\mingliub.ttc")

Region:
	              id = 528
	        start_va = 0x6df0000
	          end_va = 0x8e2dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mingliub.ttc"
	        filename = "\\Windows\\Fonts\\mingliub.ttc" (normalized: "c:\\windows\\fonts\\mingliub.ttc")

Region:
	              id = 529
	        start_va = 0x4240000
	          end_va = 0x4297fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "monbaiti.ttf"
	        filename = "\\Windows\\Fonts\\monbaiti.ttf" (normalized: "c:\\windows\\fonts\\monbaiti.ttf")

Region:
	              id = 530
	        start_va = 0x4240000
	          end_va = 0x4297fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "monbaiti.ttf"
	        filename = "\\Windows\\Fonts\\monbaiti.ttf" (normalized: "c:\\windows\\fonts\\monbaiti.ttf")

Region:
	              id = 531
	        start_va = 0x5060000
	          end_va = 0x5920fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msgothic.ttc"
	        filename = "\\Windows\\Fonts\\msgothic.ttc" (normalized: "c:\\windows\\fonts\\msgothic.ttc")

Region:
	              id = 532
	        start_va = 0x5060000
	          end_va = 0x5920fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msgothic.ttc"
	        filename = "\\Windows\\Fonts\\msgothic.ttc" (normalized: "c:\\windows\\fonts\\msgothic.ttc")

Region:
	              id = 533
	        start_va = 0x5060000
	          end_va = 0x5920fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msgothic.ttc"
	        filename = "\\Windows\\Fonts\\msgothic.ttc" (normalized: "c:\\windows\\fonts\\msgothic.ttc")

Region:
	              id = 534
	        start_va = 0x5060000
	          end_va = 0x5920fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msgothic.ttc"
	        filename = "\\Windows\\Fonts\\msgothic.ttc" (normalized: "c:\\windows\\fonts\\msgothic.ttc")

Region:
	              id = 535
	        start_va = 0x5060000
	          end_va = 0x59f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msmincho.ttc"
	        filename = "\\Windows\\Fonts\\msmincho.ttc" (normalized: "c:\\windows\\fonts\\msmincho.ttc")

Region:
	              id = 536
	        start_va = 0x5060000
	          end_va = 0x59f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msmincho.ttc"
	        filename = "\\Windows\\Fonts\\msmincho.ttc" (normalized: "c:\\windows\\fonts\\msmincho.ttc")

Region:
	              id = 537
	        start_va = 0x5060000
	          end_va = 0x59f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msmincho.ttc"
	        filename = "\\Windows\\Fonts\\msmincho.ttc" (normalized: "c:\\windows\\fonts\\msmincho.ttc")

Region:
	              id = 538
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mvboli.ttf"
	        filename = "\\Windows\\Fonts\\mvboli.ttf" (normalized: "c:\\windows\\fonts\\mvboli.ttf")

Region:
	              id = 539
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mvboli.ttf"
	        filename = "\\Windows\\Fonts\\mvboli.ttf" (normalized: "c:\\windows\\fonts\\mvboli.ttf")

Region:
	              id = 540
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntailu.ttf"
	        filename = "\\Windows\\Fonts\\ntailu.ttf" (normalized: "c:\\windows\\fonts\\ntailu.ttf")

Region:
	              id = 541
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntailu.ttf"
	        filename = "\\Windows\\Fonts\\ntailu.ttf" (normalized: "c:\\windows\\fonts\\ntailu.ttf")

Region:
	              id = 542
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntailub.ttf"
	        filename = "\\Windows\\Fonts\\ntailub.ttf" (normalized: "c:\\windows\\fonts\\ntailub.ttf")

Region:
	              id = 543
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntailub.ttf"
	        filename = "\\Windows\\Fonts\\ntailub.ttf" (normalized: "c:\\windows\\fonts\\ntailub.ttf")

Region:
	              id = 544
	        start_va = 0x4240000
	          end_va = 0x42aafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "nyala.ttf"
	        filename = "\\Windows\\Fonts\\nyala.ttf" (normalized: "c:\\windows\\fonts\\nyala.ttf")

Region:
	              id = 545
	        start_va = 0x4240000
	          end_va = 0x42aafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "nyala.ttf"
	        filename = "\\Windows\\Fonts\\nyala.ttf" (normalized: "c:\\windows\\fonts\\nyala.ttf")

Region:
	              id = 546
	        start_va = 0x3c0000
	          end_va = 0x3e3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "phagspa.ttf"
	        filename = "\\Windows\\Fonts\\phagspa.ttf" (normalized: "c:\\windows\\fonts\\phagspa.ttf")

Region:
	              id = 547
	        start_va = 0x3c0000
	          end_va = 0x3e3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "phagspa.ttf"
	        filename = "\\Windows\\Fonts\\phagspa.ttf" (normalized: "c:\\windows\\fonts\\phagspa.ttf")

Region:
	              id = 548
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "phagspab.ttf"
	        filename = "\\Windows\\Fonts\\phagspab.ttf" (normalized: "c:\\windows\\fonts\\phagspab.ttf")

Region:
	              id = 549
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "phagspab.ttf"
	        filename = "\\Windows\\Fonts\\phagspab.ttf" (normalized: "c:\\windows\\fonts\\phagspab.ttf")

Region:
	              id = 550
	        start_va = 0x3c0000
	          end_va = 0x3ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "plantc.ttf"
	        filename = "\\Windows\\Fonts\\plantc.ttf" (normalized: "c:\\windows\\fonts\\plantc.ttf")

Region:
	              id = 551
	        start_va = 0x3c0000
	          end_va = 0x3ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "plantc.ttf"
	        filename = "\\Windows\\Fonts\\plantc.ttf" (normalized: "c:\\windows\\fonts\\plantc.ttf")

Region:
	              id = 552
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "raavi.ttf"
	        filename = "\\Windows\\Fonts\\raavi.ttf" (normalized: "c:\\windows\\fonts\\raavi.ttf")

Region:
	              id = 553
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "raavi.ttf"
	        filename = "\\Windows\\Fonts\\raavi.ttf" (normalized: "c:\\windows\\fonts\\raavi.ttf")

Region:
	              id = 554
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "raavib.ttf"
	        filename = "\\Windows\\Fonts\\raavib.ttf" (normalized: "c:\\windows\\fonts\\raavib.ttf")

Region:
	              id = 555
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "raavib.ttf"
	        filename = "\\Windows\\Fonts\\raavib.ttf" (normalized: "c:\\windows\\fonts\\raavib.ttf")

Region:
	              id = 556
	        start_va = 0x4240000
	          end_va = 0x42d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoesc.ttf"
	        filename = "\\Windows\\Fonts\\segoesc.ttf" (normalized: "c:\\windows\\fonts\\segoesc.ttf")

Region:
	              id = 557
	        start_va = 0x4240000
	          end_va = 0x42d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoesc.ttf"
	        filename = "\\Windows\\Fonts\\segoesc.ttf" (normalized: "c:\\windows\\fonts\\segoesc.ttf")

Region:
	              id = 558
	        start_va = 0x4240000
	          end_va = 0x42d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoescb.ttf"
	        filename = "\\Windows\\Fonts\\segoescb.ttf" (normalized: "c:\\windows\\fonts\\segoescb.ttf")

Region:
	              id = 559
	        start_va = 0x4240000
	          end_va = 0x42d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoescb.ttf"
	        filename = "\\Windows\\Fonts\\segoescb.ttf" (normalized: "c:\\windows\\fonts\\segoescb.ttf")

Region:
	              id = 560
	        start_va = 0x4240000
	          end_va = 0x42befff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeui.ttf"
	        filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")

Region:
	              id = 561
	        start_va = 0x4240000
	          end_va = 0x42befff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeui.ttf"
	        filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")

Region:
	              id = 562
	        start_va = 0x4240000
	          end_va = 0x42b9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeuib.ttf"
	        filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf")

Region:
	              id = 563
	        start_va = 0x4240000
	          end_va = 0x42b9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeuib.ttf"
	        filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf")

Region:
	              id = 564
	        start_va = 0x4240000
	          end_va = 0x429efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeuii.ttf"
	        filename = "\\Windows\\Fonts\\segoeuii.ttf" (normalized: "c:\\windows\\fonts\\segoeuii.ttf")

Region:
	              id = 565
	        start_va = 0x4240000
	          end_va = 0x429efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeuii.ttf"
	        filename = "\\Windows\\Fonts\\segoeuii.ttf" (normalized: "c:\\windows\\fonts\\segoeuii.ttf")

Region:
	              id = 566
	        start_va = 0x4240000
	          end_va = 0x42a1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeuiz.ttf"
	        filename = "\\Windows\\Fonts\\segoeuiz.ttf" (normalized: "c:\\windows\\fonts\\segoeuiz.ttf")

Region:
	              id = 567
	        start_va = 0x4240000
	          end_va = 0x42a1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeuiz.ttf"
	        filename = "\\Windows\\Fonts\\segoeuiz.ttf" (normalized: "c:\\windows\\fonts\\segoeuiz.ttf")

Region:
	              id = 568
	        start_va = 0x4240000
	          end_va = 0x42a3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "seguisb.ttf"
	        filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf")

Region:
	              id = 569
	        start_va = 0x4240000
	          end_va = 0x42a3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "seguisb.ttf"
	        filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf")

Region:
	              id = 570
	        start_va = 0x4240000
	          end_va = 0x4290fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeuil.ttf"
	        filename = "\\Windows\\Fonts\\segoeuil.ttf" (normalized: "c:\\windows\\fonts\\segoeuil.ttf")

Region:
	              id = 571
	        start_va = 0x4240000
	          end_va = 0x4290fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeuil.ttf"
	        filename = "\\Windows\\Fonts\\segoeuil.ttf" (normalized: "c:\\windows\\fonts\\segoeuil.ttf")

Region:
	              id = 572
	        start_va = 0x4240000
	          end_va = 0x42befff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "seguisym.ttf"
	        filename = "\\Windows\\Fonts\\seguisym.ttf" (normalized: "c:\\windows\\fonts\\seguisym.ttf")

Region:
	              id = 573
	        start_va = 0x4240000
	          end_va = 0x42befff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "seguisym.ttf"
	        filename = "\\Windows\\Fonts\\seguisym.ttf" (normalized: "c:\\windows\\fonts\\seguisym.ttf")

Region:
	              id = 574
	        start_va = 0x690000
	          end_va = 0x6d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "shruti.ttf"
	        filename = "\\Windows\\Fonts\\shruti.ttf" (normalized: "c:\\windows\\fonts\\shruti.ttf")

Region:
	              id = 575
	        start_va = 0x690000
	          end_va = 0x6d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "shruti.ttf"
	        filename = "\\Windows\\Fonts\\shruti.ttf" (normalized: "c:\\windows\\fonts\\shruti.ttf")

Region:
	              id = 576
	        start_va = 0x3c0000
	          end_va = 0x3f9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "shrutib.ttf"
	        filename = "\\Windows\\Fonts\\shrutib.ttf" (normalized: "c:\\windows\\fonts\\shrutib.ttf")

Region:
	              id = 577
	        start_va = 0x3c0000
	          end_va = 0x3f9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "shrutib.ttf"
	        filename = "\\Windows\\Fonts\\shrutib.ttf" (normalized: "c:\\windows\\fonts\\shrutib.ttf")

Region:
	              id = 578
	        start_va = 0x5060000
	          end_va = 0x5efdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simsun.ttc"
	        filename = "\\Windows\\Fonts\\simsun.ttc" (normalized: "c:\\windows\\fonts\\simsun.ttc")

Region:
	              id = 579
	        start_va = 0x5060000
	          end_va = 0x5efdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simsun.ttc"
	        filename = "\\Windows\\Fonts\\simsun.ttc" (normalized: "c:\\windows\\fonts\\simsun.ttc")

Region:
	              id = 580
	        start_va = 0x5060000
	          end_va = 0x5efdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simsun.ttc"
	        filename = "\\Windows\\Fonts\\simsun.ttc" (normalized: "c:\\windows\\fonts\\simsun.ttc")

Region:
	              id = 581
	        start_va = 0x5060000
	          end_va = 0x5f11fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simsunb.ttf"
	        filename = "\\Windows\\Fonts\\simsunb.ttf" (normalized: "c:\\windows\\fonts\\simsunb.ttf")

Region:
	              id = 582
	        start_va = 0x5060000
	          end_va = 0x5f11fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simsunb.ttf"
	        filename = "\\Windows\\Fonts\\simsunb.ttf" (normalized: "c:\\windows\\fonts\\simsunb.ttf")

Region:
	              id = 583
	        start_va = 0x3c0000
	          end_va = 0x3f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sylfaen.ttf"
	        filename = "\\Windows\\Fonts\\sylfaen.ttf" (normalized: "c:\\windows\\fonts\\sylfaen.ttf")

Region:
	              id = 584
	        start_va = 0x3c0000
	          end_va = 0x3f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sylfaen.ttf"
	        filename = "\\Windows\\Fonts\\sylfaen.ttf" (normalized: "c:\\windows\\fonts\\sylfaen.ttf")

Region:
	              id = 585
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taile.ttf"
	        filename = "\\Windows\\Fonts\\taile.ttf" (normalized: "c:\\windows\\fonts\\taile.ttf")

Region:
	              id = 586
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taile.ttf"
	        filename = "\\Windows\\Fonts\\taile.ttf" (normalized: "c:\\windows\\fonts\\taile.ttf")

Region:
	              id = 587
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taileb.ttf"
	        filename = "\\Windows\\Fonts\\taileb.ttf" (normalized: "c:\\windows\\fonts\\taileb.ttf")

Region:
	              id = 588
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taileb.ttf"
	        filename = "\\Windows\\Fonts\\taileb.ttf" (normalized: "c:\\windows\\fonts\\taileb.ttf")

Region:
	              id = 589
	        start_va = 0x4240000
	          end_va = 0x430bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "times.ttf"
	        filename = "\\Windows\\Fonts\\times.ttf" (normalized: "c:\\windows\\fonts\\times.ttf")

Region:
	              id = 590
	        start_va = 0x4240000
	          end_va = 0x430bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "times.ttf"
	        filename = "\\Windows\\Fonts\\times.ttf" (normalized: "c:\\windows\\fonts\\times.ttf")

Region:
	              id = 591
	        start_va = 0x4240000
	          end_va = 0x42e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "timesi.ttf"
	        filename = "\\Windows\\Fonts\\timesi.ttf" (normalized: "c:\\windows\\fonts\\timesi.ttf")

Region:
	              id = 592
	        start_va = 0x4240000
	          end_va = 0x42e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "timesi.ttf"
	        filename = "\\Windows\\Fonts\\timesi.ttf" (normalized: "c:\\windows\\fonts\\timesi.ttf")

Region:
	              id = 593
	        start_va = 0x4240000
	          end_va = 0x430dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "timesbd.ttf"
	        filename = "\\Windows\\Fonts\\timesbd.ttf" (normalized: "c:\\windows\\fonts\\timesbd.ttf")

Region:
	              id = 594
	        start_va = 0x4240000
	          end_va = 0x430dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "timesbd.ttf"
	        filename = "\\Windows\\Fonts\\timesbd.ttf" (normalized: "c:\\windows\\fonts\\timesbd.ttf")

Region:
	              id = 595
	        start_va = 0x4240000
	          end_va = 0x42d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "timesbi.ttf"
	        filename = "\\Windows\\Fonts\\timesbi.ttf" (normalized: "c:\\windows\\fonts\\timesbi.ttf")

Region:
	              id = 596
	        start_va = 0x4240000
	          end_va = 0x42d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "timesbi.ttf"
	        filename = "\\Windows\\Fonts\\timesbi.ttf" (normalized: "c:\\windows\\fonts\\timesbi.ttf")

Region:
	              id = 597
	        start_va = 0x3c0000
	          end_va = 0x3eefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tunga.ttf"
	        filename = "\\Windows\\Fonts\\tunga.ttf" (normalized: "c:\\windows\\fonts\\tunga.ttf")

Region:
	              id = 598
	        start_va = 0x3c0000
	          end_va = 0x3eefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tunga.ttf"
	        filename = "\\Windows\\Fonts\\tunga.ttf" (normalized: "c:\\windows\\fonts\\tunga.ttf")

Region:
	              id = 599
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tungab.ttf"
	        filename = "\\Windows\\Fonts\\tungab.ttf" (normalized: "c:\\windows\\fonts\\tungab.ttf")

Region:
	              id = 600
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tungab.ttf"
	        filename = "\\Windows\\Fonts\\tungab.ttf" (normalized: "c:\\windows\\fonts\\tungab.ttf")

Region:
	              id = 601
	        start_va = 0x3c0000
	          end_va = 0x3fffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vrinda.ttf"
	        filename = "\\Windows\\Fonts\\vrinda.ttf" (normalized: "c:\\windows\\fonts\\vrinda.ttf")

Region:
	              id = 602
	        start_va = 0x3c0000
	          end_va = 0x3fffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vrinda.ttf"
	        filename = "\\Windows\\Fonts\\vrinda.ttf" (normalized: "c:\\windows\\fonts\\vrinda.ttf")

Region:
	              id = 603
	        start_va = 0x3c0000
	          end_va = 0x3fefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vrindab.ttf"
	        filename = "\\Windows\\Fonts\\vrindab.ttf" (normalized: "c:\\windows\\fonts\\vrindab.ttf")

Region:
	              id = 604
	        start_va = 0x3c0000
	          end_va = 0x3fefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vrindab.ttf"
	        filename = "\\Windows\\Fonts\\vrindab.ttf" (normalized: "c:\\windows\\fonts\\vrindab.ttf")

Region:
	              id = 605
	        start_va = 0x4240000
	          end_va = 0x4293fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "shonar.ttf"
	        filename = "\\Windows\\Fonts\\Shonar.ttf" (normalized: "c:\\windows\\fonts\\shonar.ttf")

Region:
	              id = 606
	        start_va = 0x4240000
	          end_va = 0x4293fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "shonar.ttf"
	        filename = "\\Windows\\Fonts\\Shonar.ttf" (normalized: "c:\\windows\\fonts\\shonar.ttf")

Region:
	              id = 607
	        start_va = 0x690000
	          end_va = 0x6d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "shonarb.ttf"
	        filename = "\\Windows\\Fonts\\Shonarb.ttf" (normalized: "c:\\windows\\fonts\\shonarb.ttf")

Region:
	              id = 608
	        start_va = 0x690000
	          end_va = 0x6d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "shonarb.ttf"
	        filename = "\\Windows\\Fonts\\Shonarb.ttf" (normalized: "c:\\windows\\fonts\\shonarb.ttf")

Region:
	              id = 609
	        start_va = 0x4240000
	          end_va = 0x4293fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyi.ttf"
	        filename = "\\Windows\\Fonts\\msyi.ttf" (normalized: "c:\\windows\\fonts\\msyi.ttf")

Region:
	              id = 610
	        start_va = 0x4240000
	          end_va = 0x4293fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyi.ttf"
	        filename = "\\Windows\\Fonts\\msyi.ttf" (normalized: "c:\\windows\\fonts\\msyi.ttf")

Region:
	              id = 611
	        start_va = 0x4240000
	          end_va = 0x42eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tahoma.ttf"
	        filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf")

Region:
	              id = 612
	        start_va = 0x4240000
	          end_va = 0x42eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tahoma.ttf"
	        filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf")

Region:
	              id = 613
	        start_va = 0x4240000
	          end_va = 0x42defff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tahomabd.ttf"
	        filename = "\\Windows\\Fonts\\tahomabd.ttf" (normalized: "c:\\windows\\fonts\\tahomabd.ttf")

Region:
	              id = 614
	        start_va = 0x4240000
	          end_va = 0x42defff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tahomabd.ttf"
	        filename = "\\Windows\\Fonts\\tahomabd.ttf" (normalized: "c:\\windows\\fonts\\tahomabd.ttf")

Region:
	              id = 615
	        start_va = 0x4240000
	          end_va = 0x42dffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "micross.ttf"
	        filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf")

Region:
	              id = 616
	        start_va = 0x4240000
	          end_va = 0x42dffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "micross.ttf"
	        filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf")

Region:
	              id = 617
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsa.ttf"
	        filename = "\\Windows\\Fonts\\angsa.ttf" (normalized: "c:\\windows\\fonts\\angsa.ttf")

Region:
	              id = 618
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsa.ttf"
	        filename = "\\Windows\\Fonts\\angsa.ttf" (normalized: "c:\\windows\\fonts\\angsa.ttf")

Region:
	              id = 619
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsai.ttf"
	        filename = "\\Windows\\Fonts\\angsai.ttf" (normalized: "c:\\windows\\fonts\\angsai.ttf")

Region:
	              id = 620
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsai.ttf"
	        filename = "\\Windows\\Fonts\\angsai.ttf" (normalized: "c:\\windows\\fonts\\angsai.ttf")

Region:
	              id = 621
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsab.ttf"
	        filename = "\\Windows\\Fonts\\angsab.ttf" (normalized: "c:\\windows\\fonts\\angsab.ttf")

Region:
	              id = 622
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsab.ttf"
	        filename = "\\Windows\\Fonts\\angsab.ttf" (normalized: "c:\\windows\\fonts\\angsab.ttf")

Region:
	              id = 623
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsaz.ttf"
	        filename = "\\Windows\\Fonts\\angsaz.ttf" (normalized: "c:\\windows\\fonts\\angsaz.ttf")

Region:
	              id = 624
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsaz.ttf"
	        filename = "\\Windows\\Fonts\\angsaz.ttf" (normalized: "c:\\windows\\fonts\\angsaz.ttf")

Region:
	              id = 625
	        start_va = 0x3c0000
	          end_va = 0x3f6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "aparaj.ttf"
	        filename = "\\Windows\\Fonts\\aparaj.ttf" (normalized: "c:\\windows\\fonts\\aparaj.ttf")

Region:
	              id = 626
	        start_va = 0x3c0000
	          end_va = 0x3f6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "aparaj.ttf"
	        filename = "\\Windows\\Fonts\\aparaj.ttf" (normalized: "c:\\windows\\fonts\\aparaj.ttf")

Region:
	              id = 627
	        start_va = 0x3c0000
	          end_va = 0x3f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "aparajb.ttf"
	        filename = "\\Windows\\Fonts\\aparajb.ttf" (normalized: "c:\\windows\\fonts\\aparajb.ttf")

Region:
	              id = 628
	        start_va = 0x3c0000
	          end_va = 0x3f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "aparajb.ttf"
	        filename = "\\Windows\\Fonts\\aparajb.ttf" (normalized: "c:\\windows\\fonts\\aparajb.ttf")

Region:
	              id = 629
	        start_va = 0x3c0000
	          end_va = 0x3f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "aparajbi.ttf"
	        filename = "\\Windows\\Fonts\\aparajbi.ttf" (normalized: "c:\\windows\\fonts\\aparajbi.ttf")

Region:
	              id = 630
	        start_va = 0x3c0000
	          end_va = 0x3f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "aparajbi.ttf"
	        filename = "\\Windows\\Fonts\\aparajbi.ttf" (normalized: "c:\\windows\\fonts\\aparajbi.ttf")

Region:
	              id = 631
	        start_va = 0x3c0000
	          end_va = 0x3fafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "aparaji.ttf"
	        filename = "\\Windows\\Fonts\\aparaji.ttf" (normalized: "c:\\windows\\fonts\\aparaji.ttf")

Region:
	              id = 632
	        start_va = 0x3c0000
	          end_va = 0x3fafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "aparaji.ttf"
	        filename = "\\Windows\\Fonts\\aparaji.ttf" (normalized: "c:\\windows\\fonts\\aparaji.ttf")

Region:
	              id = 633
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordia.ttf"
	        filename = "\\Windows\\Fonts\\cordia.ttf" (normalized: "c:\\windows\\fonts\\cordia.ttf")

Region:
	              id = 634
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordia.ttf"
	        filename = "\\Windows\\Fonts\\cordia.ttf" (normalized: "c:\\windows\\fonts\\cordia.ttf")

Region:
	              id = 635
	        start_va = 0x3c0000
	          end_va = 0x3d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiai.ttf"
	        filename = "\\Windows\\Fonts\\cordiai.ttf" (normalized: "c:\\windows\\fonts\\cordiai.ttf")

Region:
	              id = 636
	        start_va = 0x3c0000
	          end_va = 0x3d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiai.ttf"
	        filename = "\\Windows\\Fonts\\cordiai.ttf" (normalized: "c:\\windows\\fonts\\cordiai.ttf")

Region:
	              id = 637
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiab.ttf"
	        filename = "\\Windows\\Fonts\\cordiab.ttf" (normalized: "c:\\windows\\fonts\\cordiab.ttf")

Region:
	              id = 638
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiab.ttf"
	        filename = "\\Windows\\Fonts\\cordiab.ttf" (normalized: "c:\\windows\\fonts\\cordiab.ttf")

Region:
	              id = 639
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiaz.ttf"
	        filename = "\\Windows\\Fonts\\cordiaz.ttf" (normalized: "c:\\windows\\fonts\\cordiaz.ttf")

Region:
	              id = 640
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiaz.ttf"
	        filename = "\\Windows\\Fonts\\cordiaz.ttf" (normalized: "c:\\windows\\fonts\\cordiaz.ttf")

Region:
	              id = 641
	        start_va = 0x690000
	          end_va = 0x6dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ebrima.ttf"
	        filename = "\\Windows\\Fonts\\ebrima.ttf" (normalized: "c:\\windows\\fonts\\ebrima.ttf")

Region:
	              id = 642
	        start_va = 0x690000
	          end_va = 0x6dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ebrima.ttf"
	        filename = "\\Windows\\Fonts\\ebrima.ttf" (normalized: "c:\\windows\\fonts\\ebrima.ttf")

Region:
	              id = 643
	        start_va = 0x690000
	          end_va = 0x6d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ebrimabd.ttf"
	        filename = "\\Windows\\Fonts\\ebrimabd.ttf" (normalized: "c:\\windows\\fonts\\ebrimabd.ttf")

Region:
	              id = 644
	        start_va = 0x690000
	          end_va = 0x6d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ebrimabd.ttf"
	        filename = "\\Windows\\Fonts\\ebrimabd.ttf" (normalized: "c:\\windows\\fonts\\ebrimabd.ttf")

Region:
	              id = 645
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gisha.ttf"
	        filename = "\\Windows\\Fonts\\gisha.ttf" (normalized: "c:\\windows\\fonts\\gisha.ttf")

Region:
	              id = 646
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gisha.ttf"
	        filename = "\\Windows\\Fonts\\gisha.ttf" (normalized: "c:\\windows\\fonts\\gisha.ttf")

Region:
	              id = 647
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gishabd.ttf"
	        filename = "\\Windows\\Fonts\\gishabd.ttf" (normalized: "c:\\windows\\fonts\\gishabd.ttf")

Region:
	              id = 648
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gishabd.ttf"
	        filename = "\\Windows\\Fonts\\gishabd.ttf" (normalized: "c:\\windows\\fonts\\gishabd.ttf")

Region:
	              id = 649
	        start_va = 0x3c0000
	          end_va = 0x3f1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kokila.ttf"
	        filename = "\\Windows\\Fonts\\kokila.ttf" (normalized: "c:\\windows\\fonts\\kokila.ttf")

Region:
	              id = 650
	        start_va = 0x3c0000
	          end_va = 0x3f1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kokila.ttf"
	        filename = "\\Windows\\Fonts\\kokila.ttf" (normalized: "c:\\windows\\fonts\\kokila.ttf")

Region:
	              id = 651
	        start_va = 0x3c0000
	          end_va = 0x3f1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kokilab.ttf"
	        filename = "\\Windows\\Fonts\\kokilab.ttf" (normalized: "c:\\windows\\fonts\\kokilab.ttf")

Region:
	              id = 652
	        start_va = 0x3c0000
	          end_va = 0x3f1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kokilab.ttf"
	        filename = "\\Windows\\Fonts\\kokilab.ttf" (normalized: "c:\\windows\\fonts\\kokilab.ttf")

Region:
	              id = 653
	        start_va = 0x3c0000
	          end_va = 0x3f9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kokilabi.ttf"
	        filename = "\\Windows\\Fonts\\kokilabi.ttf" (normalized: "c:\\windows\\fonts\\kokilabi.ttf")

Region:
	              id = 654
	        start_va = 0x3c0000
	          end_va = 0x3f9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kokilabi.ttf"
	        filename = "\\Windows\\Fonts\\kokilabi.ttf" (normalized: "c:\\windows\\fonts\\kokilabi.ttf")

Region:
	              id = 655
	        start_va = 0x3c0000
	          end_va = 0x3fbfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kokilai.ttf"
	        filename = "\\Windows\\Fonts\\kokilai.ttf" (normalized: "c:\\windows\\fonts\\kokilai.ttf")

Region:
	              id = 656
	        start_va = 0x3c0000
	          end_va = 0x3fbfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kokilai.ttf"
	        filename = "\\Windows\\Fonts\\kokilai.ttf" (normalized: "c:\\windows\\fonts\\kokilai.ttf")

Region:
	              id = 657
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "leelawad.ttf"
	        filename = "\\Windows\\Fonts\\leelawad.ttf" (normalized: "c:\\windows\\fonts\\leelawad.ttf")

Region:
	              id = 658
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "leelawad.ttf"
	        filename = "\\Windows\\Fonts\\leelawad.ttf" (normalized: "c:\\windows\\fonts\\leelawad.ttf")

Region:
	              id = 659
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "leelawdb.ttf"
	        filename = "\\Windows\\Fonts\\leelawdb.ttf" (normalized: "c:\\windows\\fonts\\leelawdb.ttf")

Region:
	              id = 660
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "leelawdb.ttf"
	        filename = "\\Windows\\Fonts\\leelawdb.ttf" (normalized: "c:\\windows\\fonts\\leelawdb.ttf")

Region:
	              id = 661
	        start_va = 0x3c0000
	          end_va = 0x3f6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msuighur.ttf"
	        filename = "\\Windows\\Fonts\\msuighur.ttf" (normalized: "c:\\windows\\fonts\\msuighur.ttf")

Region:
	              id = 662
	        start_va = 0x3c0000
	          end_va = 0x3f6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msuighur.ttf"
	        filename = "\\Windows\\Fonts\\msuighur.ttf" (normalized: "c:\\windows\\fonts\\msuighur.ttf")

Region:
	              id = 663
	        start_va = 0x4240000
	          end_va = 0x4293fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "moolbor.ttf"
	        filename = "\\Windows\\Fonts\\moolbor.ttf" (normalized: "c:\\windows\\fonts\\moolbor.ttf")

Region:
	              id = 664
	        start_va = 0x4240000
	          end_va = 0x4293fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "moolbor.ttf"
	        filename = "\\Windows\\Fonts\\moolbor.ttf" (normalized: "c:\\windows\\fonts\\moolbor.ttf")

Region:
	              id = 665
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "symbol.ttf"
	        filename = "\\Windows\\Fonts\\symbol.ttf" (normalized: "c:\\windows\\fonts\\symbol.ttf")

Region:
	              id = 666
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "symbol.ttf"
	        filename = "\\Windows\\Fonts\\symbol.ttf" (normalized: "c:\\windows\\fonts\\symbol.ttf")

Region:
	              id = 667
	        start_va = 0x3c0000
	          end_va = 0x3f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "utsaah.ttf"
	        filename = "\\Windows\\Fonts\\utsaah.ttf" (normalized: "c:\\windows\\fonts\\utsaah.ttf")

Region:
	              id = 668
	        start_va = 0x3c0000
	          end_va = 0x3f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "utsaah.ttf"
	        filename = "\\Windows\\Fonts\\utsaah.ttf" (normalized: "c:\\windows\\fonts\\utsaah.ttf")

Region:
	              id = 669
	        start_va = 0x3c0000
	          end_va = 0x3f3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "utsaahb.ttf"
	        filename = "\\Windows\\Fonts\\utsaahb.ttf" (normalized: "c:\\windows\\fonts\\utsaahb.ttf")

Region:
	              id = 670
	        start_va = 0x3c0000
	          end_va = 0x3f3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "utsaahb.ttf"
	        filename = "\\Windows\\Fonts\\utsaahb.ttf" (normalized: "c:\\windows\\fonts\\utsaahb.ttf")

Region:
	              id = 671
	        start_va = 0x3c0000
	          end_va = 0x3f5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "utsaahbi.ttf"
	        filename = "\\Windows\\Fonts\\utsaahbi.ttf" (normalized: "c:\\windows\\fonts\\utsaahbi.ttf")

Region:
	              id = 672
	        start_va = 0x3c0000
	          end_va = 0x3f5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "utsaahbi.ttf"
	        filename = "\\Windows\\Fonts\\utsaahbi.ttf" (normalized: "c:\\windows\\fonts\\utsaahbi.ttf")

Region:
	              id = 673
	        start_va = 0x3c0000
	          end_va = 0x3fafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "utsaahi.ttf"
	        filename = "\\Windows\\Fonts\\utsaahi.ttf" (normalized: "c:\\windows\\fonts\\utsaahi.ttf")

Region:
	              id = 674
	        start_va = 0x3c0000
	          end_va = 0x3fafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "utsaahi.ttf"
	        filename = "\\Windows\\Fonts\\utsaahi.ttf" (normalized: "c:\\windows\\fonts\\utsaahi.ttf")

Region:
	              id = 675
	        start_va = 0x3c0000
	          end_va = 0x3e9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vijaya.ttf"
	        filename = "\\Windows\\Fonts\\vijaya.ttf" (normalized: "c:\\windows\\fonts\\vijaya.ttf")

Region:
	              id = 676
	        start_va = 0x3c0000
	          end_va = 0x3e9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vijaya.ttf"
	        filename = "\\Windows\\Fonts\\vijaya.ttf" (normalized: "c:\\windows\\fonts\\vijaya.ttf")

Region:
	              id = 677
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vijayab.ttf"
	        filename = "\\Windows\\Fonts\\vijayab.ttf" (normalized: "c:\\windows\\fonts\\vijayab.ttf")

Region:
	              id = 678
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vijayab.ttf"
	        filename = "\\Windows\\Fonts\\vijayab.ttf" (normalized: "c:\\windows\\fonts\\vijayab.ttf")

Region:
	              id = 679
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wingding.ttf"
	        filename = "\\Windows\\Fonts\\wingding.ttf" (normalized: "c:\\windows\\fonts\\wingding.ttf")

Region:
	              id = 680
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wingding.ttf"
	        filename = "\\Windows\\Fonts\\wingding.ttf" (normalized: "c:\\windows\\fonts\\wingding.ttf")

Region:
	              id = 681
	        start_va = 0x370000
	          end_va = 0x372fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "modern.fon"
	        filename = "\\Windows\\Fonts\\modern.fon" (normalized: "c:\\windows\\fonts\\modern.fon")

Region:
	              id = 682
	        start_va = 0x370000
	          end_va = 0x373fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "roman.fon"
	        filename = "\\Windows\\Fonts\\roman.fon" (normalized: "c:\\windows\\fonts\\roman.fon")

Region:
	              id = 683
	        start_va = 0x370000
	          end_va = 0x372fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "script.fon"
	        filename = "\\Windows\\Fonts\\script.fon" (normalized: "c:\\windows\\fonts\\script.fon")

Region:
	              id = 684
	        start_va = 0x3c0000
	          end_va = 0x3e6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "andlso.ttf"
	        filename = "\\Windows\\Fonts\\andlso.ttf" (normalized: "c:\\windows\\fonts\\andlso.ttf")

Region:
	              id = 685
	        start_va = 0x3c0000
	          end_va = 0x3e6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "andlso.ttf"
	        filename = "\\Windows\\Fonts\\andlso.ttf" (normalized: "c:\\windows\\fonts\\andlso.ttf")

Region:
	              id = 686
	        start_va = 0x4240000
	          end_va = 0x42d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arabtype.ttf"
	        filename = "\\Windows\\Fonts\\arabtype.ttf" (normalized: "c:\\windows\\fonts\\arabtype.ttf")

Region:
	              id = 687
	        start_va = 0x4240000
	          end_va = 0x42d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arabtype.ttf"
	        filename = "\\Windows\\Fonts\\arabtype.ttf" (normalized: "c:\\windows\\fonts\\arabtype.ttf")

Region:
	              id = 688
	        start_va = 0x3c0000
	          end_va = 0x3defff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simpo.ttf"
	        filename = "\\Windows\\Fonts\\simpo.ttf" (normalized: "c:\\windows\\fonts\\simpo.ttf")

Region:
	              id = 689
	        start_va = 0x3c0000
	          end_va = 0x3defff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simpo.ttf"
	        filename = "\\Windows\\Fonts\\simpo.ttf" (normalized: "c:\\windows\\fonts\\simpo.ttf")

Region:
	              id = 690
	        start_va = 0x3c0000
	          end_va = 0x3dcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simpbdo.ttf"
	        filename = "\\Windows\\Fonts\\simpbdo.ttf" (normalized: "c:\\windows\\fonts\\simpbdo.ttf")

Region:
	              id = 691
	        start_va = 0x3c0000
	          end_va = 0x3dcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simpbdo.ttf"
	        filename = "\\Windows\\Fonts\\simpbdo.ttf" (normalized: "c:\\windows\\fonts\\simpbdo.ttf")

Region:
	              id = 692
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simpfxo.ttf"
	        filename = "\\Windows\\Fonts\\simpfxo.ttf" (normalized: "c:\\windows\\fonts\\simpfxo.ttf")

Region:
	              id = 693
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simpfxo.ttf"
	        filename = "\\Windows\\Fonts\\simpfxo.ttf" (normalized: "c:\\windows\\fonts\\simpfxo.ttf")

Region:
	              id = 694
	        start_va = 0x4240000
	          end_va = 0x429afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "majalla.ttf"
	        filename = "\\Windows\\Fonts\\majalla.ttf" (normalized: "c:\\windows\\fonts\\majalla.ttf")

Region:
	              id = 695
	        start_va = 0x4240000
	          end_va = 0x429afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "majalla.ttf"
	        filename = "\\Windows\\Fonts\\majalla.ttf" (normalized: "c:\\windows\\fonts\\majalla.ttf")

Region:
	              id = 696
	        start_va = 0x4240000
	          end_va = 0x429bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "majallab.ttf"
	        filename = "\\Windows\\Fonts\\majallab.ttf" (normalized: "c:\\windows\\fonts\\majallab.ttf")

Region:
	              id = 697
	        start_va = 0x4240000
	          end_va = 0x429bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "majallab.ttf"
	        filename = "\\Windows\\Fonts\\majallab.ttf" (normalized: "c:\\windows\\fonts\\majallab.ttf")

Region:
	              id = 698
	        start_va = 0x3c0000
	          end_va = 0x3ebfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "trado.ttf"
	        filename = "\\Windows\\Fonts\\trado.ttf" (normalized: "c:\\windows\\fonts\\trado.ttf")

Region:
	              id = 699
	        start_va = 0x3c0000
	          end_va = 0x3ebfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "trado.ttf"
	        filename = "\\Windows\\Fonts\\trado.ttf" (normalized: "c:\\windows\\fonts\\trado.ttf")

Region:
	              id = 700
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tradbdo.ttf"
	        filename = "\\Windows\\Fonts\\tradbdo.ttf" (normalized: "c:\\windows\\fonts\\tradbdo.ttf")

Region:
	              id = 701
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tradbdo.ttf"
	        filename = "\\Windows\\Fonts\\tradbdo.ttf" (normalized: "c:\\windows\\fonts\\tradbdo.ttf")

Region:
	              id = 702
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ahronbd.ttf"
	        filename = "\\Windows\\Fonts\\ahronbd.ttf" (normalized: "c:\\windows\\fonts\\ahronbd.ttf")

Region:
	              id = 703
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ahronbd.ttf"
	        filename = "\\Windows\\Fonts\\ahronbd.ttf" (normalized: "c:\\windows\\fonts\\ahronbd.ttf")

Region:
	              id = 704
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "david.ttf"
	        filename = "\\Windows\\Fonts\\david.ttf" (normalized: "c:\\windows\\fonts\\david.ttf")

Region:
	              id = 705
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "david.ttf"
	        filename = "\\Windows\\Fonts\\david.ttf" (normalized: "c:\\windows\\fonts\\david.ttf")

Region:
	              id = 706
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "davidbd.ttf"
	        filename = "\\Windows\\Fonts\\davidbd.ttf" (normalized: "c:\\windows\\fonts\\davidbd.ttf")

Region:
	              id = 707
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "davidbd.ttf"
	        filename = "\\Windows\\Fonts\\davidbd.ttf" (normalized: "c:\\windows\\fonts\\davidbd.ttf")

Region:
	              id = 708
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frank.ttf"
	        filename = "\\Windows\\Fonts\\frank.ttf" (normalized: "c:\\windows\\fonts\\frank.ttf")

Region:
	              id = 709
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frank.ttf"
	        filename = "\\Windows\\Fonts\\frank.ttf" (normalized: "c:\\windows\\fonts\\frank.ttf")

Region:
	              id = 710
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lvnm.ttf"
	        filename = "\\Windows\\Fonts\\lvnm.ttf" (normalized: "c:\\windows\\fonts\\lvnm.ttf")

Region:
	              id = 711
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lvnm.ttf"
	        filename = "\\Windows\\Fonts\\lvnm.ttf" (normalized: "c:\\windows\\fonts\\lvnm.ttf")

Region:
	              id = 712
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lvnmbd.ttf"
	        filename = "\\Windows\\Fonts\\lvnmbd.ttf" (normalized: "c:\\windows\\fonts\\lvnmbd.ttf")

Region:
	              id = 713
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lvnmbd.ttf"
	        filename = "\\Windows\\Fonts\\lvnmbd.ttf" (normalized: "c:\\windows\\fonts\\lvnmbd.ttf")

Region:
	              id = 714
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mriam.ttf"
	        filename = "\\Windows\\Fonts\\mriam.ttf" (normalized: "c:\\windows\\fonts\\mriam.ttf")

Region:
	              id = 715
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mriam.ttf"
	        filename = "\\Windows\\Fonts\\mriam.ttf" (normalized: "c:\\windows\\fonts\\mriam.ttf")

Region:
	              id = 716
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mriamc.ttf"
	        filename = "\\Windows\\Fonts\\mriamc.ttf" (normalized: "c:\\windows\\fonts\\mriamc.ttf")

Region:
	              id = 717
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mriamc.ttf"
	        filename = "\\Windows\\Fonts\\mriamc.ttf" (normalized: "c:\\windows\\fonts\\mriamc.ttf")

Region:
	              id = 718
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "nrkis.ttf"
	        filename = "\\Windows\\Fonts\\nrkis.ttf" (normalized: "c:\\windows\\fonts\\nrkis.ttf")

Region:
	              id = 719
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "nrkis.ttf"
	        filename = "\\Windows\\Fonts\\nrkis.ttf" (normalized: "c:\\windows\\fonts\\nrkis.ttf")

Region:
	              id = 720
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rod.ttf"
	        filename = "\\Windows\\Fonts\\rod.ttf" (normalized: "c:\\windows\\fonts\\rod.ttf")

Region:
	              id = 721
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rod.ttf"
	        filename = "\\Windows\\Fonts\\rod.ttf" (normalized: "c:\\windows\\fonts\\rod.ttf")

Region:
	              id = 722
	        start_va = 0x5060000
	          end_va = 0x5a76fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simfang.ttf"
	        filename = "\\Windows\\Fonts\\simfang.ttf" (normalized: "c:\\windows\\fonts\\simfang.ttf")

Region:
	              id = 723
	        start_va = 0x5060000
	          end_va = 0x5a76fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simfang.ttf"
	        filename = "\\Windows\\Fonts\\simfang.ttf" (normalized: "c:\\windows\\fonts\\simfang.ttf")

Region:
	              id = 724
	        start_va = 0x5060000
	          end_va = 0x59acfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simhei.ttf"
	        filename = "\\Windows\\Fonts\\simhei.ttf" (normalized: "c:\\windows\\fonts\\simhei.ttf")

Region:
	              id = 725
	        start_va = 0x5060000
	          end_va = 0x59acfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simhei.ttf"
	        filename = "\\Windows\\Fonts\\simhei.ttf" (normalized: "c:\\windows\\fonts\\simhei.ttf")

Region:
	              id = 726
	        start_va = 0x6df0000
	          end_va = 0x7dbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006df0000"
	        filename = ""

Region:
	              id = 727
	        start_va = 0x5060000
	          end_va = 0x5b9dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simkai.ttf"
	        filename = "\\Windows\\Fonts\\simkai.ttf" (normalized: "c:\\windows\\fonts\\simkai.ttf")

Region:
	              id = 728
	        start_va = 0x5060000
	          end_va = 0x5b9dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "simkai.ttf"
	        filename = "\\Windows\\Fonts\\simkai.ttf" (normalized: "c:\\windows\\fonts\\simkai.ttf")

Region:
	              id = 729
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsau.ttf"
	        filename = "\\Windows\\Fonts\\angsau.ttf" (normalized: "c:\\windows\\fonts\\angsau.ttf")

Region:
	              id = 730
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsau.ttf"
	        filename = "\\Windows\\Fonts\\angsau.ttf" (normalized: "c:\\windows\\fonts\\angsau.ttf")

Region:
	              id = 731
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsaui.ttf"
	        filename = "\\Windows\\Fonts\\angsaui.ttf" (normalized: "c:\\windows\\fonts\\angsaui.ttf")

Region:
	              id = 732
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsaui.ttf"
	        filename = "\\Windows\\Fonts\\angsaui.ttf" (normalized: "c:\\windows\\fonts\\angsaui.ttf")

Region:
	              id = 733
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsaub.ttf"
	        filename = "\\Windows\\Fonts\\angsaub.ttf" (normalized: "c:\\windows\\fonts\\angsaub.ttf")

Region:
	              id = 734
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsaub.ttf"
	        filename = "\\Windows\\Fonts\\angsaub.ttf" (normalized: "c:\\windows\\fonts\\angsaub.ttf")

Region:
	              id = 735
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsauz.ttf"
	        filename = "\\Windows\\Fonts\\angsauz.ttf" (normalized: "c:\\windows\\fonts\\angsauz.ttf")

Region:
	              id = 736
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "angsauz.ttf"
	        filename = "\\Windows\\Fonts\\angsauz.ttf" (normalized: "c:\\windows\\fonts\\angsauz.ttf")

Region:
	              id = 737
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browa.ttf"
	        filename = "\\Windows\\Fonts\\browa.ttf" (normalized: "c:\\windows\\fonts\\browa.ttf")

Region:
	              id = 738
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browa.ttf"
	        filename = "\\Windows\\Fonts\\browa.ttf" (normalized: "c:\\windows\\fonts\\browa.ttf")

Region:
	              id = 739
	        start_va = 0x3c0000
	          end_va = 0x3d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browai.ttf"
	        filename = "\\Windows\\Fonts\\browai.ttf" (normalized: "c:\\windows\\fonts\\browai.ttf")

Region:
	              id = 740
	        start_va = 0x3c0000
	          end_va = 0x3d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browai.ttf"
	        filename = "\\Windows\\Fonts\\browai.ttf" (normalized: "c:\\windows\\fonts\\browai.ttf")

Region:
	              id = 741
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browab.ttf"
	        filename = "\\Windows\\Fonts\\browab.ttf" (normalized: "c:\\windows\\fonts\\browab.ttf")

Region:
	              id = 742
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browab.ttf"
	        filename = "\\Windows\\Fonts\\browab.ttf" (normalized: "c:\\windows\\fonts\\browab.ttf")

Region:
	              id = 743
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browaz.ttf"
	        filename = "\\Windows\\Fonts\\browaz.ttf" (normalized: "c:\\windows\\fonts\\browaz.ttf")

Region:
	              id = 744
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browaz.ttf"
	        filename = "\\Windows\\Fonts\\browaz.ttf" (normalized: "c:\\windows\\fonts\\browaz.ttf")

Region:
	              id = 745
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browau.ttf"
	        filename = "\\Windows\\Fonts\\browau.ttf" (normalized: "c:\\windows\\fonts\\browau.ttf")

Region:
	              id = 746
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browau.ttf"
	        filename = "\\Windows\\Fonts\\browau.ttf" (normalized: "c:\\windows\\fonts\\browau.ttf")

Region:
	              id = 747
	        start_va = 0x3c0000
	          end_va = 0x3d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browaui.ttf"
	        filename = "\\Windows\\Fonts\\browaui.ttf" (normalized: "c:\\windows\\fonts\\browaui.ttf")

Region:
	              id = 748
	        start_va = 0x3c0000
	          end_va = 0x3d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browaui.ttf"
	        filename = "\\Windows\\Fonts\\browaui.ttf" (normalized: "c:\\windows\\fonts\\browaui.ttf")

Region:
	              id = 749
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browaub.ttf"
	        filename = "\\Windows\\Fonts\\browaub.ttf" (normalized: "c:\\windows\\fonts\\browaub.ttf")

Region:
	              id = 750
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browaub.ttf"
	        filename = "\\Windows\\Fonts\\browaub.ttf" (normalized: "c:\\windows\\fonts\\browaub.ttf")

Region:
	              id = 751
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browauz.ttf"
	        filename = "\\Windows\\Fonts\\browauz.ttf" (normalized: "c:\\windows\\fonts\\browauz.ttf")

Region:
	              id = 752
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "browauz.ttf"
	        filename = "\\Windows\\Fonts\\browauz.ttf" (normalized: "c:\\windows\\fonts\\browauz.ttf")

Region:
	              id = 753
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiau.ttf"
	        filename = "\\Windows\\Fonts\\cordiau.ttf" (normalized: "c:\\windows\\fonts\\cordiau.ttf")

Region:
	              id = 754
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiau.ttf"
	        filename = "\\Windows\\Fonts\\cordiau.ttf" (normalized: "c:\\windows\\fonts\\cordiau.ttf")

Region:
	              id = 755
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiaub.ttf"
	        filename = "\\Windows\\Fonts\\cordiaub.ttf" (normalized: "c:\\windows\\fonts\\cordiaub.ttf")

Region:
	              id = 756
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiaub.ttf"
	        filename = "\\Windows\\Fonts\\cordiaub.ttf" (normalized: "c:\\windows\\fonts\\cordiaub.ttf")

Region:
	              id = 757
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiauz.ttf"
	        filename = "\\Windows\\Fonts\\cordiauz.ttf" (normalized: "c:\\windows\\fonts\\cordiauz.ttf")

Region:
	              id = 758
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiauz.ttf"
	        filename = "\\Windows\\Fonts\\cordiauz.ttf" (normalized: "c:\\windows\\fonts\\cordiauz.ttf")

Region:
	              id = 759
	        start_va = 0x3c0000
	          end_va = 0x3d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiaui.ttf"
	        filename = "\\Windows\\Fonts\\cordiaui.ttf" (normalized: "c:\\windows\\fonts\\cordiaui.ttf")

Region:
	              id = 760
	        start_va = 0x3c0000
	          end_va = 0x3d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cordiaui.ttf"
	        filename = "\\Windows\\Fonts\\cordiaui.ttf" (normalized: "c:\\windows\\fonts\\cordiaui.ttf")

Region:
	              id = 761
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcdl.ttf"
	        filename = "\\Windows\\Fonts\\upcdl.ttf" (normalized: "c:\\windows\\fonts\\upcdl.ttf")

Region:
	              id = 762
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcdl.ttf"
	        filename = "\\Windows\\Fonts\\upcdl.ttf" (normalized: "c:\\windows\\fonts\\upcdl.ttf")

Region:
	              id = 763
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcdi.ttf"
	        filename = "\\Windows\\Fonts\\upcdi.ttf" (normalized: "c:\\windows\\fonts\\upcdi.ttf")

Region:
	              id = 764
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcdi.ttf"
	        filename = "\\Windows\\Fonts\\upcdi.ttf" (normalized: "c:\\windows\\fonts\\upcdi.ttf")

Region:
	              id = 765
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcdb.ttf"
	        filename = "\\Windows\\Fonts\\upcdb.ttf" (normalized: "c:\\windows\\fonts\\upcdb.ttf")

Region:
	              id = 766
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcdb.ttf"
	        filename = "\\Windows\\Fonts\\upcdb.ttf" (normalized: "c:\\windows\\fonts\\upcdb.ttf")

Region:
	              id = 767
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcdbi.ttf"
	        filename = "\\Windows\\Fonts\\upcdbi.ttf" (normalized: "c:\\windows\\fonts\\upcdbi.ttf")

Region:
	              id = 768
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcdbi.ttf"
	        filename = "\\Windows\\Fonts\\upcdbi.ttf" (normalized: "c:\\windows\\fonts\\upcdbi.ttf")

Region:
	              id = 769
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcel.ttf"
	        filename = "\\Windows\\Fonts\\upcel.ttf" (normalized: "c:\\windows\\fonts\\upcel.ttf")

Region:
	              id = 770
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcel.ttf"
	        filename = "\\Windows\\Fonts\\upcel.ttf" (normalized: "c:\\windows\\fonts\\upcel.ttf")

Region:
	              id = 771
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcei.ttf"
	        filename = "\\Windows\\Fonts\\upcei.ttf" (normalized: "c:\\windows\\fonts\\upcei.ttf")

Region:
	              id = 772
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcei.ttf"
	        filename = "\\Windows\\Fonts\\upcei.ttf" (normalized: "c:\\windows\\fonts\\upcei.ttf")

Region:
	              id = 773
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upceb.ttf"
	        filename = "\\Windows\\Fonts\\upceb.ttf" (normalized: "c:\\windows\\fonts\\upceb.ttf")

Region:
	              id = 774
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upceb.ttf"
	        filename = "\\Windows\\Fonts\\upceb.ttf" (normalized: "c:\\windows\\fonts\\upceb.ttf")

Region:
	              id = 775
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcebi.ttf"
	        filename = "\\Windows\\Fonts\\upcebi.ttf" (normalized: "c:\\windows\\fonts\\upcebi.ttf")

Region:
	              id = 776
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcebi.ttf"
	        filename = "\\Windows\\Fonts\\upcebi.ttf" (normalized: "c:\\windows\\fonts\\upcebi.ttf")

Region:
	              id = 777
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcfl.ttf"
	        filename = "\\Windows\\Fonts\\upcfl.ttf" (normalized: "c:\\windows\\fonts\\upcfl.ttf")

Region:
	              id = 778
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcfl.ttf"
	        filename = "\\Windows\\Fonts\\upcfl.ttf" (normalized: "c:\\windows\\fonts\\upcfl.ttf")

Region:
	              id = 779
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcfi.ttf"
	        filename = "\\Windows\\Fonts\\upcfi.ttf" (normalized: "c:\\windows\\fonts\\upcfi.ttf")

Region:
	              id = 780
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcfi.ttf"
	        filename = "\\Windows\\Fonts\\upcfi.ttf" (normalized: "c:\\windows\\fonts\\upcfi.ttf")

Region:
	              id = 781
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcfb.ttf"
	        filename = "\\Windows\\Fonts\\upcfb.ttf" (normalized: "c:\\windows\\fonts\\upcfb.ttf")

Region:
	              id = 782
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcfb.ttf"
	        filename = "\\Windows\\Fonts\\upcfb.ttf" (normalized: "c:\\windows\\fonts\\upcfb.ttf")

Region:
	              id = 783
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcfbi.ttf"
	        filename = "\\Windows\\Fonts\\upcfbi.ttf" (normalized: "c:\\windows\\fonts\\upcfbi.ttf")

Region:
	              id = 784
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcfbi.ttf"
	        filename = "\\Windows\\Fonts\\upcfbi.ttf" (normalized: "c:\\windows\\fonts\\upcfbi.ttf")

Region:
	              id = 785
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcil.ttf"
	        filename = "\\Windows\\Fonts\\upcil.ttf" (normalized: "c:\\windows\\fonts\\upcil.ttf")

Region:
	              id = 786
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcil.ttf"
	        filename = "\\Windows\\Fonts\\upcil.ttf" (normalized: "c:\\windows\\fonts\\upcil.ttf")

Region:
	              id = 787
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcii.ttf"
	        filename = "\\Windows\\Fonts\\upcii.ttf" (normalized: "c:\\windows\\fonts\\upcii.ttf")

Region:
	              id = 788
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcii.ttf"
	        filename = "\\Windows\\Fonts\\upcii.ttf" (normalized: "c:\\windows\\fonts\\upcii.ttf")

Region:
	              id = 789
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcib.ttf"
	        filename = "\\Windows\\Fonts\\upcib.ttf" (normalized: "c:\\windows\\fonts\\upcib.ttf")

Region:
	              id = 790
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcib.ttf"
	        filename = "\\Windows\\Fonts\\upcib.ttf" (normalized: "c:\\windows\\fonts\\upcib.ttf")

Region:
	              id = 791
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcibi.ttf"
	        filename = "\\Windows\\Fonts\\upcibi.ttf" (normalized: "c:\\windows\\fonts\\upcibi.ttf")

Region:
	              id = 792
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcibi.ttf"
	        filename = "\\Windows\\Fonts\\upcibi.ttf" (normalized: "c:\\windows\\fonts\\upcibi.ttf")

Region:
	              id = 793
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcjl.ttf"
	        filename = "\\Windows\\Fonts\\upcjl.ttf" (normalized: "c:\\windows\\fonts\\upcjl.ttf")

Region:
	              id = 794
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcjl.ttf"
	        filename = "\\Windows\\Fonts\\upcjl.ttf" (normalized: "c:\\windows\\fonts\\upcjl.ttf")

Region:
	              id = 795
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcji.ttf"
	        filename = "\\Windows\\Fonts\\upcji.ttf" (normalized: "c:\\windows\\fonts\\upcji.ttf")

Region:
	              id = 796
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcji.ttf"
	        filename = "\\Windows\\Fonts\\upcji.ttf" (normalized: "c:\\windows\\fonts\\upcji.ttf")

Region:
	              id = 797
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcjb.ttf"
	        filename = "\\Windows\\Fonts\\upcjb.ttf" (normalized: "c:\\windows\\fonts\\upcjb.ttf")

Region:
	              id = 798
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcjb.ttf"
	        filename = "\\Windows\\Fonts\\upcjb.ttf" (normalized: "c:\\windows\\fonts\\upcjb.ttf")

Region:
	              id = 799
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcjbi.ttf"
	        filename = "\\Windows\\Fonts\\upcjbi.ttf" (normalized: "c:\\windows\\fonts\\upcjbi.ttf")

Region:
	              id = 800
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcjbi.ttf"
	        filename = "\\Windows\\Fonts\\upcjbi.ttf" (normalized: "c:\\windows\\fonts\\upcjbi.ttf")

Region:
	              id = 801
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upckl.ttf"
	        filename = "\\Windows\\Fonts\\upckl.ttf" (normalized: "c:\\windows\\fonts\\upckl.ttf")

Region:
	              id = 802
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upckl.ttf"
	        filename = "\\Windows\\Fonts\\upckl.ttf" (normalized: "c:\\windows\\fonts\\upckl.ttf")

Region:
	              id = 803
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcki.ttf"
	        filename = "\\Windows\\Fonts\\upcki.ttf" (normalized: "c:\\windows\\fonts\\upcki.ttf")

Region:
	              id = 804
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcki.ttf"
	        filename = "\\Windows\\Fonts\\upcki.ttf" (normalized: "c:\\windows\\fonts\\upcki.ttf")

Region:
	              id = 805
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upckb.ttf"
	        filename = "\\Windows\\Fonts\\upckb.ttf" (normalized: "c:\\windows\\fonts\\upckb.ttf")

Region:
	              id = 806
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upckb.ttf"
	        filename = "\\Windows\\Fonts\\upckb.ttf" (normalized: "c:\\windows\\fonts\\upckb.ttf")

Region:
	              id = 807
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upckbi.ttf"
	        filename = "\\Windows\\Fonts\\upckbi.ttf" (normalized: "c:\\windows\\fonts\\upckbi.ttf")

Region:
	              id = 808
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upckbi.ttf"
	        filename = "\\Windows\\Fonts\\upckbi.ttf" (normalized: "c:\\windows\\fonts\\upckbi.ttf")

Region:
	              id = 809
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcll.ttf"
	        filename = "\\Windows\\Fonts\\upcll.ttf" (normalized: "c:\\windows\\fonts\\upcll.ttf")

Region:
	              id = 810
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcll.ttf"
	        filename = "\\Windows\\Fonts\\upcll.ttf" (normalized: "c:\\windows\\fonts\\upcll.ttf")

Region:
	              id = 811
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcli.ttf"
	        filename = "\\Windows\\Fonts\\upcli.ttf" (normalized: "c:\\windows\\fonts\\upcli.ttf")

Region:
	              id = 812
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upcli.ttf"
	        filename = "\\Windows\\Fonts\\upcli.ttf" (normalized: "c:\\windows\\fonts\\upcli.ttf")

Region:
	              id = 813
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upclb.ttf"
	        filename = "\\Windows\\Fonts\\upclb.ttf" (normalized: "c:\\windows\\fonts\\upclb.ttf")

Region:
	              id = 814
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upclb.ttf"
	        filename = "\\Windows\\Fonts\\upclb.ttf" (normalized: "c:\\windows\\fonts\\upclb.ttf")

Region:
	              id = 815
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upclbi.ttf"
	        filename = "\\Windows\\Fonts\\upclbi.ttf" (normalized: "c:\\windows\\fonts\\upclbi.ttf")

Region:
	              id = 816
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "upclbi.ttf"
	        filename = "\\Windows\\Fonts\\upclbi.ttf" (normalized: "c:\\windows\\fonts\\upclbi.ttf")

Region:
	              id = 817
	        start_va = 0x5060000
	          end_va = 0x5550fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kaiu.ttf"
	        filename = "\\Windows\\Fonts\\kaiu.ttf" (normalized: "c:\\windows\\fonts\\kaiu.ttf")

Region:
	              id = 818
	        start_va = 0x5060000
	          end_va = 0x5550fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kaiu.ttf"
	        filename = "\\Windows\\Fonts\\kaiu.ttf" (normalized: "c:\\windows\\fonts\\kaiu.ttf")

Region:
	              id = 819
	        start_va = 0x690000
	          end_va = 0x6dffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "l_10646.ttf"
	        filename = "\\Windows\\Fonts\\l_10646.ttf" (normalized: "c:\\windows\\fonts\\l_10646.ttf")

Region:
	              id = 820
	        start_va = 0x690000
	          end_va = 0x6dffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "l_10646.ttf"
	        filename = "\\Windows\\Fonts\\l_10646.ttf" (normalized: "c:\\windows\\fonts\\l_10646.ttf")

Region:
	              id = 821
	        start_va = 0x3c0000
	          end_va = 0x3ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ariblk.ttf"
	        filename = "\\Windows\\Fonts\\ariblk.ttf" (normalized: "c:\\windows\\fonts\\ariblk.ttf")

Region:
	              id = 822
	        start_va = 0x3c0000
	          end_va = 0x3ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ariblk.ttf"
	        filename = "\\Windows\\Fonts\\ariblk.ttf" (normalized: "c:\\windows\\fonts\\ariblk.ttf")

Region:
	              id = 823
	        start_va = 0x4240000
	          end_va = 0x4306fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibri.ttf"
	        filename = "\\Windows\\Fonts\\calibri.ttf" (normalized: "c:\\windows\\fonts\\calibri.ttf")

Region:
	              id = 824
	        start_va = 0x4240000
	          end_va = 0x4306fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibri.ttf"
	        filename = "\\Windows\\Fonts\\calibri.ttf" (normalized: "c:\\windows\\fonts\\calibri.ttf")

Region:
	              id = 825
	        start_va = 0x4240000
	          end_va = 0x4310fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibrii.ttf"
	        filename = "\\Windows\\Fonts\\calibrii.ttf" (normalized: "c:\\windows\\fonts\\calibrii.ttf")

Region:
	              id = 826
	        start_va = 0x4240000
	          end_va = 0x4310fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibrii.ttf"
	        filename = "\\Windows\\Fonts\\calibrii.ttf" (normalized: "c:\\windows\\fonts\\calibrii.ttf")

Region:
	              id = 827
	        start_va = 0x4240000
	          end_va = 0x430ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibrib.ttf"
	        filename = "\\Windows\\Fonts\\calibrib.ttf" (normalized: "c:\\windows\\fonts\\calibrib.ttf")

Region:
	              id = 828
	        start_va = 0x4240000
	          end_va = 0x430ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibrib.ttf"
	        filename = "\\Windows\\Fonts\\calibrib.ttf" (normalized: "c:\\windows\\fonts\\calibrib.ttf")

Region:
	              id = 829
	        start_va = 0x4240000
	          end_va = 0x431bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibriz.ttf"
	        filename = "\\Windows\\Fonts\\calibriz.ttf" (normalized: "c:\\windows\\fonts\\calibriz.ttf")

Region:
	              id = 830
	        start_va = 0x4240000
	          end_va = 0x431bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibriz.ttf"
	        filename = "\\Windows\\Fonts\\calibriz.ttf" (normalized: "c:\\windows\\fonts\\calibriz.ttf")

Region:
	              id = 831
	        start_va = 0x5060000
	          end_va = 0x51ecfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cambria.ttc"
	        filename = "\\Windows\\Fonts\\cambria.ttc" (normalized: "c:\\windows\\fonts\\cambria.ttc")

Region:
	              id = 832
	        start_va = 0x5060000
	          end_va = 0x51ecfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cambria.ttc"
	        filename = "\\Windows\\Fonts\\cambria.ttc" (normalized: "c:\\windows\\fonts\\cambria.ttc")

Region:
	              id = 833
	        start_va = 0x5060000
	          end_va = 0x51ecfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cambria.ttc"
	        filename = "\\Windows\\Fonts\\cambria.ttc" (normalized: "c:\\windows\\fonts\\cambria.ttc")

Region:
	              id = 834
	        start_va = 0x4240000
	          end_va = 0x4309fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cambriai.ttf"
	        filename = "\\Windows\\Fonts\\cambriai.ttf" (normalized: "c:\\windows\\fonts\\cambriai.ttf")

Region:
	              id = 835
	        start_va = 0x4240000
	          end_va = 0x4309fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cambriai.ttf"
	        filename = "\\Windows\\Fonts\\cambriai.ttf" (normalized: "c:\\windows\\fonts\\cambriai.ttf")

Region:
	              id = 836
	        start_va = 0x4240000
	          end_va = 0x4301fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cambriab.ttf"
	        filename = "\\Windows\\Fonts\\cambriab.ttf" (normalized: "c:\\windows\\fonts\\cambriab.ttf")

Region:
	              id = 837
	        start_va = 0x4240000
	          end_va = 0x4301fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cambriab.ttf"
	        filename = "\\Windows\\Fonts\\cambriab.ttf" (normalized: "c:\\windows\\fonts\\cambriab.ttf")

Region:
	              id = 838
	        start_va = 0x4240000
	          end_va = 0x4304fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cambriaz.ttf"
	        filename = "\\Windows\\Fonts\\cambriaz.ttf" (normalized: "c:\\windows\\fonts\\cambriaz.ttf")

Region:
	              id = 839
	        start_va = 0x4240000
	          end_va = 0x4304fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cambriaz.ttf"
	        filename = "\\Windows\\Fonts\\cambriaz.ttf" (normalized: "c:\\windows\\fonts\\cambriaz.ttf")

Region:
	              id = 840
	        start_va = 0x3c0000
	          end_va = 0x3f5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "candara.ttf"
	        filename = "\\Windows\\Fonts\\Candara.ttf" (normalized: "c:\\windows\\fonts\\candara.ttf")

Region:
	              id = 841
	        start_va = 0x3c0000
	          end_va = 0x3f5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "candara.ttf"
	        filename = "\\Windows\\Fonts\\Candara.ttf" (normalized: "c:\\windows\\fonts\\candara.ttf")

Region:
	              id = 842
	        start_va = 0x3c0000
	          end_va = 0x3f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "candarai.ttf"
	        filename = "\\Windows\\Fonts\\Candarai.ttf" (normalized: "c:\\windows\\fonts\\candarai.ttf")

Region:
	              id = 843
	        start_va = 0x3c0000
	          end_va = 0x3f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "candarai.ttf"
	        filename = "\\Windows\\Fonts\\Candarai.ttf" (normalized: "c:\\windows\\fonts\\candarai.ttf")

Region:
	              id = 844
	        start_va = 0x3c0000
	          end_va = 0x3f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "candarab.ttf"
	        filename = "\\Windows\\Fonts\\Candarab.ttf" (normalized: "c:\\windows\\fonts\\candarab.ttf")

Region:
	              id = 845
	        start_va = 0x3c0000
	          end_va = 0x3f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "candarab.ttf"
	        filename = "\\Windows\\Fonts\\Candarab.ttf" (normalized: "c:\\windows\\fonts\\candarab.ttf")

Region:
	              id = 846
	        start_va = 0x3c0000
	          end_va = 0x3f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "candaraz.ttf"
	        filename = "\\Windows\\Fonts\\Candaraz.ttf" (normalized: "c:\\windows\\fonts\\candaraz.ttf")

Region:
	              id = 847
	        start_va = 0x3c0000
	          end_va = 0x3f7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "candaraz.ttf"
	        filename = "\\Windows\\Fonts\\Candaraz.ttf" (normalized: "c:\\windows\\fonts\\candaraz.ttf")

Region:
	              id = 848
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "comic.ttf"
	        filename = "\\Windows\\Fonts\\comic.ttf" (normalized: "c:\\windows\\fonts\\comic.ttf")

Region:
	              id = 849
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "comic.ttf"
	        filename = "\\Windows\\Fonts\\comic.ttf" (normalized: "c:\\windows\\fonts\\comic.ttf")

Region:
	              id = 850
	        start_va = 0x3c0000
	          end_va = 0x3dcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "comicbd.ttf"
	        filename = "\\Windows\\Fonts\\comicbd.ttf" (normalized: "c:\\windows\\fonts\\comicbd.ttf")

Region:
	              id = 851
	        start_va = 0x3c0000
	          end_va = 0x3dcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "comicbd.ttf"
	        filename = "\\Windows\\Fonts\\comicbd.ttf" (normalized: "c:\\windows\\fonts\\comicbd.ttf")

Region:
	              id = 852
	        start_va = 0x4240000
	          end_va = 0x4297fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "consola.ttf"
	        filename = "\\Windows\\Fonts\\consola.ttf" (normalized: "c:\\windows\\fonts\\consola.ttf")

Region:
	              id = 853
	        start_va = 0x4240000
	          end_va = 0x4297fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "consola.ttf"
	        filename = "\\Windows\\Fonts\\consola.ttf" (normalized: "c:\\windows\\fonts\\consola.ttf")

Region:
	              id = 854
	        start_va = 0x4240000
	          end_va = 0x4299fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "consolai.ttf"
	        filename = "\\Windows\\Fonts\\consolai.ttf" (normalized: "c:\\windows\\fonts\\consolai.ttf")

Region:
	              id = 855
	        start_va = 0x4240000
	          end_va = 0x4299fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "consolai.ttf"
	        filename = "\\Windows\\Fonts\\consolai.ttf" (normalized: "c:\\windows\\fonts\\consolai.ttf")

Region:
	              id = 856
	        start_va = 0x4240000
	          end_va = 0x4299fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "consolab.ttf"
	        filename = "\\Windows\\Fonts\\consolab.ttf" (normalized: "c:\\windows\\fonts\\consolab.ttf")

Region:
	              id = 857
	        start_va = 0x4240000
	          end_va = 0x4299fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "consolab.ttf"
	        filename = "\\Windows\\Fonts\\consolab.ttf" (normalized: "c:\\windows\\fonts\\consolab.ttf")

Region:
	              id = 858
	        start_va = 0x4240000
	          end_va = 0x429bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "consolaz.ttf"
	        filename = "\\Windows\\Fonts\\consolaz.ttf" (normalized: "c:\\windows\\fonts\\consolaz.ttf")

Region:
	              id = 859
	        start_va = 0x4240000
	          end_va = 0x429bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "consolaz.ttf"
	        filename = "\\Windows\\Fonts\\consolaz.ttf" (normalized: "c:\\windows\\fonts\\consolaz.ttf")

Region:
	              id = 860
	        start_va = 0x4240000
	          end_va = 0x42adfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "constan.ttf"
	        filename = "\\Windows\\Fonts\\constan.ttf" (normalized: "c:\\windows\\fonts\\constan.ttf")

Region:
	              id = 861
	        start_va = 0x4240000
	          end_va = 0x42adfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "constan.ttf"
	        filename = "\\Windows\\Fonts\\constan.ttf" (normalized: "c:\\windows\\fonts\\constan.ttf")

Region:
	              id = 862
	        start_va = 0x4240000
	          end_va = 0x42adfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "constani.ttf"
	        filename = "\\Windows\\Fonts\\constani.ttf" (normalized: "c:\\windows\\fonts\\constani.ttf")

Region:
	              id = 863
	        start_va = 0x4240000
	          end_va = 0x42adfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "constani.ttf"
	        filename = "\\Windows\\Fonts\\constani.ttf" (normalized: "c:\\windows\\fonts\\constani.ttf")

Region:
	              id = 864
	        start_va = 0x4240000
	          end_va = 0x42aefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "constanb.ttf"
	        filename = "\\Windows\\Fonts\\constanb.ttf" (normalized: "c:\\windows\\fonts\\constanb.ttf")

Region:
	              id = 865
	        start_va = 0x4240000
	          end_va = 0x42aefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "constanb.ttf"
	        filename = "\\Windows\\Fonts\\constanb.ttf" (normalized: "c:\\windows\\fonts\\constanb.ttf")

Region:
	              id = 866
	        start_va = 0x4240000
	          end_va = 0x42aefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "constanz.ttf"
	        filename = "\\Windows\\Fonts\\constanz.ttf" (normalized: "c:\\windows\\fonts\\constanz.ttf")

Region:
	              id = 867
	        start_va = 0x4240000
	          end_va = 0x42aefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "constanz.ttf"
	        filename = "\\Windows\\Fonts\\constanz.ttf" (normalized: "c:\\windows\\fonts\\constanz.ttf")

Region:
	              id = 868
	        start_va = 0x3c0000
	          end_va = 0x3fffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "corbel.ttf"
	        filename = "\\Windows\\Fonts\\corbel.ttf" (normalized: "c:\\windows\\fonts\\corbel.ttf")

Region:
	              id = 869
	        start_va = 0x3c0000
	          end_va = 0x3fffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "corbel.ttf"
	        filename = "\\Windows\\Fonts\\corbel.ttf" (normalized: "c:\\windows\\fonts\\corbel.ttf")

Region:
	              id = 870
	        start_va = 0x690000
	          end_va = 0x6d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "corbeli.ttf"
	        filename = "\\Windows\\Fonts\\corbeli.ttf" (normalized: "c:\\windows\\fonts\\corbeli.ttf")

Region:
	              id = 871
	        start_va = 0x690000
	          end_va = 0x6d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "corbeli.ttf"
	        filename = "\\Windows\\Fonts\\corbeli.ttf" (normalized: "c:\\windows\\fonts\\corbeli.ttf")

Region:
	              id = 872
	        start_va = 0x690000
	          end_va = 0x6d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "corbelb.ttf"
	        filename = "\\Windows\\Fonts\\corbelb.ttf" (normalized: "c:\\windows\\fonts\\corbelb.ttf")

Region:
	              id = 873
	        start_va = 0x690000
	          end_va = 0x6d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "corbelb.ttf"
	        filename = "\\Windows\\Fonts\\corbelb.ttf" (normalized: "c:\\windows\\fonts\\corbelb.ttf")

Region:
	              id = 874
	        start_va = 0x690000
	          end_va = 0x6d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "corbelz.ttf"
	        filename = "\\Windows\\Fonts\\corbelz.ttf" (normalized: "c:\\windows\\fonts\\corbelz.ttf")

Region:
	              id = 875
	        start_va = 0x690000
	          end_va = 0x6d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "corbelz.ttf"
	        filename = "\\Windows\\Fonts\\corbelz.ttf" (normalized: "c:\\windows\\fonts\\corbelz.ttf")

Region:
	              id = 876
	        start_va = 0x3c0000
	          end_va = 0x3e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "framd.ttf"
	        filename = "\\Windows\\Fonts\\framd.ttf" (normalized: "c:\\windows\\fonts\\framd.ttf")

Region:
	              id = 877
	        start_va = 0x3c0000
	          end_va = 0x3e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "framd.ttf"
	        filename = "\\Windows\\Fonts\\framd.ttf" (normalized: "c:\\windows\\fonts\\framd.ttf")

Region:
	              id = 878
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "framdit.ttf"
	        filename = "\\Windows\\Fonts\\framdit.ttf" (normalized: "c:\\windows\\fonts\\framdit.ttf")

Region:
	              id = 879
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "framdit.ttf"
	        filename = "\\Windows\\Fonts\\framdit.ttf" (normalized: "c:\\windows\\fonts\\framdit.ttf")

Region:
	              id = 880
	        start_va = 0x5060000
	          end_va = 0x5218fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gabriola.ttf"
	        filename = "\\Windows\\Fonts\\Gabriola.ttf" (normalized: "c:\\windows\\fonts\\gabriola.ttf")

Region:
	              id = 881
	        start_va = 0x5060000
	          end_va = 0x5218fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gabriola.ttf"
	        filename = "\\Windows\\Fonts\\Gabriola.ttf" (normalized: "c:\\windows\\fonts\\gabriola.ttf")

Region:
	              id = 882
	        start_va = 0x4240000
	          end_va = 0x431afff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004240000"
	        filename = ""

Region:
	              id = 883
	        start_va = 0x3c0000
	          end_va = 0x3e6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "georgia.ttf"
	        filename = "\\Windows\\Fonts\\georgia.ttf" (normalized: "c:\\windows\\fonts\\georgia.ttf")

Region:
	              id = 884
	        start_va = 0x3c0000
	          end_va = 0x3e6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "georgia.ttf"
	        filename = "\\Windows\\Fonts\\georgia.ttf" (normalized: "c:\\windows\\fonts\\georgia.ttf")

Region:
	              id = 885
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "georgiai.ttf"
	        filename = "\\Windows\\Fonts\\georgiai.ttf" (normalized: "c:\\windows\\fonts\\georgiai.ttf")

Region:
	              id = 886
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "georgiai.ttf"
	        filename = "\\Windows\\Fonts\\georgiai.ttf" (normalized: "c:\\windows\\fonts\\georgiai.ttf")

Region:
	              id = 887
	        start_va = 0x3c0000
	          end_va = 0x3e3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "georgiab.ttf"
	        filename = "\\Windows\\Fonts\\georgiab.ttf" (normalized: "c:\\windows\\fonts\\georgiab.ttf")

Region:
	              id = 888
	        start_va = 0x3c0000
	          end_va = 0x3e3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "georgiab.ttf"
	        filename = "\\Windows\\Fonts\\georgiab.ttf" (normalized: "c:\\windows\\fonts\\georgiab.ttf")

Region:
	              id = 889
	        start_va = 0x3c0000
	          end_va = 0x3e8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "georgiaz.ttf"
	        filename = "\\Windows\\Fonts\\georgiaz.ttf" (normalized: "c:\\windows\\fonts\\georgiaz.ttf")

Region:
	              id = 890
	        start_va = 0x3c0000
	          end_va = 0x3e8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "georgiaz.ttf"
	        filename = "\\Windows\\Fonts\\georgiaz.ttf" (normalized: "c:\\windows\\fonts\\georgiaz.ttf")

Region:
	              id = 891
	        start_va = 0x4470000
	          end_va = 0x44e3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "pala.ttf"
	        filename = "\\Windows\\Fonts\\pala.ttf" (normalized: "c:\\windows\\fonts\\pala.ttf")

Region:
	              id = 892
	        start_va = 0x4470000
	          end_va = 0x44e3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "pala.ttf"
	        filename = "\\Windows\\Fonts\\pala.ttf" (normalized: "c:\\windows\\fonts\\pala.ttf")

Region:
	              id = 893
	        start_va = 0x4470000
	          end_va = 0x44d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "palai.ttf"
	        filename = "\\Windows\\Fonts\\palai.ttf" (normalized: "c:\\windows\\fonts\\palai.ttf")

Region:
	              id = 894
	        start_va = 0x4470000
	          end_va = 0x44d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "palai.ttf"
	        filename = "\\Windows\\Fonts\\palai.ttf" (normalized: "c:\\windows\\fonts\\palai.ttf")

Region:
	              id = 895
	        start_va = 0x4470000
	          end_va = 0x44d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "palab.ttf"
	        filename = "\\Windows\\Fonts\\palab.ttf" (normalized: "c:\\windows\\fonts\\palab.ttf")

Region:
	              id = 896
	        start_va = 0x4470000
	          end_va = 0x44d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "palab.ttf"
	        filename = "\\Windows\\Fonts\\palab.ttf" (normalized: "c:\\windows\\fonts\\palab.ttf")

Region:
	              id = 897
	        start_va = 0x4470000
	          end_va = 0x44c2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "palabi.ttf"
	        filename = "\\Windows\\Fonts\\palabi.ttf" (normalized: "c:\\windows\\fonts\\palabi.ttf")

Region:
	              id = 898
	        start_va = 0x4470000
	          end_va = 0x44c2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "palabi.ttf"
	        filename = "\\Windows\\Fonts\\palabi.ttf" (normalized: "c:\\windows\\fonts\\palabi.ttf")

Region:
	              id = 899
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoepr.ttf"
	        filename = "\\Windows\\Fonts\\segoepr.ttf" (normalized: "c:\\windows\\fonts\\segoepr.ttf")

Region:
	              id = 900
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoepr.ttf"
	        filename = "\\Windows\\Fonts\\segoepr.ttf" (normalized: "c:\\windows\\fonts\\segoepr.ttf")

Region:
	              id = 901
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeprb.ttf"
	        filename = "\\Windows\\Fonts\\segoeprb.ttf" (normalized: "c:\\windows\\fonts\\segoeprb.ttf")

Region:
	              id = 902
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeprb.ttf"
	        filename = "\\Windows\\Fonts\\segoeprb.ttf" (normalized: "c:\\windows\\fonts\\segoeprb.ttf")

Region:
	              id = 903
	        start_va = 0x3c0000
	          end_va = 0x3e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "trebuc.ttf"
	        filename = "\\Windows\\Fonts\\trebuc.ttf" (normalized: "c:\\windows\\fonts\\trebuc.ttf")

Region:
	              id = 904
	        start_va = 0x3c0000
	          end_va = 0x3e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "trebuc.ttf"
	        filename = "\\Windows\\Fonts\\trebuc.ttf" (normalized: "c:\\windows\\fonts\\trebuc.ttf")

Region:
	              id = 905
	        start_va = 0x3c0000
	          end_va = 0x3e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "trebucit.ttf"
	        filename = "\\Windows\\Fonts\\trebucit.ttf" (normalized: "c:\\windows\\fonts\\trebucit.ttf")

Region:
	              id = 906
	        start_va = 0x3c0000
	          end_va = 0x3e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "trebucit.ttf"
	        filename = "\\Windows\\Fonts\\trebucit.ttf" (normalized: "c:\\windows\\fonts\\trebucit.ttf")

Region:
	              id = 907
	        start_va = 0x3c0000
	          end_va = 0x3defff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "trebucbd.ttf"
	        filename = "\\Windows\\Fonts\\trebucbd.ttf" (normalized: "c:\\windows\\fonts\\trebucbd.ttf")

Region:
	              id = 908
	        start_va = 0x3c0000
	          end_va = 0x3defff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "trebucbd.ttf"
	        filename = "\\Windows\\Fonts\\trebucbd.ttf" (normalized: "c:\\windows\\fonts\\trebucbd.ttf")

Region:
	              id = 909
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "trebucbi.ttf"
	        filename = "\\Windows\\Fonts\\trebucbi.ttf" (normalized: "c:\\windows\\fonts\\trebucbi.ttf")

Region:
	              id = 910
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "trebucbi.ttf"
	        filename = "\\Windows\\Fonts\\trebucbi.ttf" (normalized: "c:\\windows\\fonts\\trebucbi.ttf")

Region:
	              id = 911
	        start_va = 0x3c0000
	          end_va = 0x3edfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "verdana.ttf"
	        filename = "\\Windows\\Fonts\\verdana.ttf" (normalized: "c:\\windows\\fonts\\verdana.ttf")

Region:
	              id = 912
	        start_va = 0x3c0000
	          end_va = 0x3edfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "verdana.ttf"
	        filename = "\\Windows\\Fonts\\verdana.ttf" (normalized: "c:\\windows\\fonts\\verdana.ttf")

Region:
	              id = 913
	        start_va = 0x3c0000
	          end_va = 0x3ebfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "verdanai.ttf"
	        filename = "\\Windows\\Fonts\\verdanai.ttf" (normalized: "c:\\windows\\fonts\\verdanai.ttf")

Region:
	              id = 914
	        start_va = 0x3c0000
	          end_va = 0x3ebfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "verdanai.ttf"
	        filename = "\\Windows\\Fonts\\verdanai.ttf" (normalized: "c:\\windows\\fonts\\verdanai.ttf")

Region:
	              id = 915
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "verdanab.ttf"
	        filename = "\\Windows\\Fonts\\verdanab.ttf" (normalized: "c:\\windows\\fonts\\verdanab.ttf")

Region:
	              id = 916
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "verdanab.ttf"
	        filename = "\\Windows\\Fonts\\verdanab.ttf" (normalized: "c:\\windows\\fonts\\verdanab.ttf")

Region:
	              id = 917
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "verdanaz.ttf"
	        filename = "\\Windows\\Fonts\\verdanaz.ttf" (normalized: "c:\\windows\\fonts\\verdanaz.ttf")

Region:
	              id = 918
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "verdanaz.ttf"
	        filename = "\\Windows\\Fonts\\verdanaz.ttf" (normalized: "c:\\windows\\fonts\\verdanaz.ttf")

Region:
	              id = 919
	        start_va = 0x3c0000
	          end_va = 0x3ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "webdings.ttf"
	        filename = "\\Windows\\Fonts\\webdings.ttf" (normalized: "c:\\windows\\fonts\\webdings.ttf")

Region:
	              id = 920
	        start_va = 0x3c0000
	          end_va = 0x3ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "webdings.ttf"
	        filename = "\\Windows\\Fonts\\webdings.ttf" (normalized: "c:\\windows\\fonts\\webdings.ttf")

Region:
	              id = 921
	        start_va = 0x370000
	          end_va = 0x375fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "coure.fon"
	        filename = "\\Windows\\Fonts\\coure.fon" (normalized: "c:\\windows\\fonts\\coure.fon")

Region:
	              id = 922
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "serife.fon"
	        filename = "\\Windows\\Fonts\\serife.fon" (normalized: "c:\\windows\\fonts\\serife.fon")

Region:
	              id = 923
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sserife.fon"
	        filename = "\\Windows\\Fonts\\sserife.fon" (normalized: "c:\\windows\\fonts\\sserife.fon")

Region:
	              id = 924
	        start_va = 0x370000
	          end_va = 0x376fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "smalle.fon"
	        filename = "\\Windows\\Fonts\\smalle.fon" (normalized: "c:\\windows\\fonts\\smalle.fon")

Region:
	              id = 925
	        start_va = 0x370000
	          end_va = 0x375fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "smallf.fon"
	        filename = "\\Windows\\Fonts\\smallf.fon" (normalized: "c:\\windows\\fonts\\smallf.fon")

Region:
	              id = 926
	        start_va = 0x5060000
	          end_va = 0x51a8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "nirmala.ttf"
	        filename = "\\Windows\\Fonts\\NIRMALA.TTF" (normalized: "c:\\windows\\fonts\\nirmala.ttf")

Region:
	              id = 927
	        start_va = 0x5060000
	          end_va = 0x51a8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "nirmala.ttf"
	        filename = "\\Windows\\Fonts\\NIRMALA.TTF" (normalized: "c:\\windows\\fonts\\nirmala.ttf")

Region:
	              id = 928
	        start_va = 0x5060000
	          end_va = 0x519cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "nirmalab.ttf"
	        filename = "\\Windows\\Fonts\\NIRMALAB.TTF" (normalized: "c:\\windows\\fonts\\nirmalab.ttf")

Region:
	              id = 929
	        start_va = 0x5060000
	          end_va = 0x519cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "nirmalab.ttf"
	        filename = "\\Windows\\Fonts\\NIRMALAB.TTF" (normalized: "c:\\windows\\fonts\\nirmalab.ttf")

Region:
	              id = 930
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "agencyb.ttf"
	        filename = "\\Windows\\Fonts\\AGENCYB.TTF" (normalized: "c:\\windows\\fonts\\agencyb.ttf")

Region:
	              id = 931
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "agencyb.ttf"
	        filename = "\\Windows\\Fonts\\AGENCYB.TTF" (normalized: "c:\\windows\\fonts\\agencyb.ttf")

Region:
	              id = 932
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "agencyr.ttf"
	        filename = "\\Windows\\Fonts\\AGENCYR.TTF" (normalized: "c:\\windows\\fonts\\agencyr.ttf")

Region:
	              id = 933
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "agencyr.ttf"
	        filename = "\\Windows\\Fonts\\AGENCYR.TTF" (normalized: "c:\\windows\\fonts\\agencyr.ttf")

Region:
	              id = 934
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "alger.ttf"
	        filename = "\\Windows\\Fonts\\ALGER.TTF" (normalized: "c:\\windows\\fonts\\alger.ttf")

Region:
	              id = 935
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "alger.ttf"
	        filename = "\\Windows\\Fonts\\ALGER.TTF" (normalized: "c:\\windows\\fonts\\alger.ttf")

Region:
	              id = 936
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "antquab.ttf"
	        filename = "\\Windows\\Fonts\\ANTQUAB.TTF" (normalized: "c:\\windows\\fonts\\antquab.ttf")

Region:
	              id = 937
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "antquab.ttf"
	        filename = "\\Windows\\Fonts\\ANTQUAB.TTF" (normalized: "c:\\windows\\fonts\\antquab.ttf")

Region:
	              id = 938
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "antquabi.ttf"
	        filename = "\\Windows\\Fonts\\ANTQUABI.TTF" (normalized: "c:\\windows\\fonts\\antquabi.ttf")

Region:
	              id = 939
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "antquabi.ttf"
	        filename = "\\Windows\\Fonts\\ANTQUABI.TTF" (normalized: "c:\\windows\\fonts\\antquabi.ttf")

Region:
	              id = 940
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "antquai.ttf"
	        filename = "\\Windows\\Fonts\\ANTQUAI.TTF" (normalized: "c:\\windows\\fonts\\antquai.ttf")

Region:
	              id = 941
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "antquai.ttf"
	        filename = "\\Windows\\Fonts\\ANTQUAI.TTF" (normalized: "c:\\windows\\fonts\\antquai.ttf")

Region:
	              id = 942
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialn.ttf"
	        filename = "\\Windows\\Fonts\\ARIALN.TTF" (normalized: "c:\\windows\\fonts\\arialn.ttf")

Region:
	              id = 943
	        start_va = 0x3c0000
	          end_va = 0x3eafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialn.ttf"
	        filename = "\\Windows\\Fonts\\ARIALN.TTF" (normalized: "c:\\windows\\fonts\\arialn.ttf")

Region:
	              id = 944
	        start_va = 0x3c0000
	          end_va = 0x3ecfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialnb.ttf"
	        filename = "\\Windows\\Fonts\\ARIALNB.TTF" (normalized: "c:\\windows\\fonts\\arialnb.ttf")

Region:
	              id = 945
	        start_va = 0x3c0000
	          end_va = 0x3ecfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialnb.ttf"
	        filename = "\\Windows\\Fonts\\ARIALNB.TTF" (normalized: "c:\\windows\\fonts\\arialnb.ttf")

Region:
	              id = 946
	        start_va = 0x3c0000
	          end_va = 0x3ebfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialnbi.ttf"
	        filename = "\\Windows\\Fonts\\ARIALNBI.TTF" (normalized: "c:\\windows\\fonts\\arialnbi.ttf")

Region:
	              id = 947
	        start_va = 0x3c0000
	          end_va = 0x3ebfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialnbi.ttf"
	        filename = "\\Windows\\Fonts\\ARIALNBI.TTF" (normalized: "c:\\windows\\fonts\\arialnbi.ttf")

Region:
	              id = 948
	        start_va = 0x3c0000
	          end_va = 0x3ecfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialni.ttf"
	        filename = "\\Windows\\Fonts\\ARIALNI.TTF" (normalized: "c:\\windows\\fonts\\arialni.ttf")

Region:
	              id = 949
	        start_va = 0x3c0000
	          end_va = 0x3ecfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arialni.ttf"
	        filename = "\\Windows\\Fonts\\ARIALNI.TTF" (normalized: "c:\\windows\\fonts\\arialni.ttf")

Region:
	              id = 950
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arlrdbd.ttf"
	        filename = "\\Windows\\Fonts\\ARLRDBD.TTF" (normalized: "c:\\windows\\fonts\\arlrdbd.ttf")

Region:
	              id = 951
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "arlrdbd.ttf"
	        filename = "\\Windows\\Fonts\\ARLRDBD.TTF" (normalized: "c:\\windows\\fonts\\arlrdbd.ttf")

Region:
	              id = 952
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "baskvill.ttf"
	        filename = "\\Windows\\Fonts\\BASKVILL.TTF" (normalized: "c:\\windows\\fonts\\baskvill.ttf")

Region:
	              id = 953
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "baskvill.ttf"
	        filename = "\\Windows\\Fonts\\BASKVILL.TTF" (normalized: "c:\\windows\\fonts\\baskvill.ttf")

Region:
	              id = 954
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bauhs93.ttf"
	        filename = "\\Windows\\Fonts\\BAUHS93.TTF" (normalized: "c:\\windows\\fonts\\bauhs93.ttf")

Region:
	              id = 955
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bauhs93.ttf"
	        filename = "\\Windows\\Fonts\\BAUHS93.TTF" (normalized: "c:\\windows\\fonts\\bauhs93.ttf")

Region:
	              id = 956
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bell.ttf"
	        filename = "\\Windows\\Fonts\\BELL.TTF" (normalized: "c:\\windows\\fonts\\bell.ttf")

Region:
	              id = 957
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bell.ttf"
	        filename = "\\Windows\\Fonts\\BELL.TTF" (normalized: "c:\\windows\\fonts\\bell.ttf")

Region:
	              id = 958
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bellb.ttf"
	        filename = "\\Windows\\Fonts\\BELLB.TTF" (normalized: "c:\\windows\\fonts\\bellb.ttf")

Region:
	              id = 959
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bellb.ttf"
	        filename = "\\Windows\\Fonts\\BELLB.TTF" (normalized: "c:\\windows\\fonts\\bellb.ttf")

Region:
	              id = 960
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "belli.ttf"
	        filename = "\\Windows\\Fonts\\BELLI.TTF" (normalized: "c:\\windows\\fonts\\belli.ttf")

Region:
	              id = 961
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "belli.ttf"
	        filename = "\\Windows\\Fonts\\BELLI.TTF" (normalized: "c:\\windows\\fonts\\belli.ttf")

Region:
	              id = 962
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bernhc.ttf"
	        filename = "\\Windows\\Fonts\\BERNHC.TTF" (normalized: "c:\\windows\\fonts\\bernhc.ttf")

Region:
	              id = 963
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bernhc.ttf"
	        filename = "\\Windows\\Fonts\\BERNHC.TTF" (normalized: "c:\\windows\\fonts\\bernhc.ttf")

Region:
	              id = 964
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bkant.ttf"
	        filename = "\\Windows\\Fonts\\BKANT.TTF" (normalized: "c:\\windows\\fonts\\bkant.ttf")

Region:
	              id = 965
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bkant.ttf"
	        filename = "\\Windows\\Fonts\\BKANT.TTF" (normalized: "c:\\windows\\fonts\\bkant.ttf")

Region:
	              id = 966
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_b.ttf"
	        filename = "\\Windows\\Fonts\\BOD_B.TTF" (normalized: "c:\\windows\\fonts\\bod_b.ttf")

Region:
	              id = 967
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_b.ttf"
	        filename = "\\Windows\\Fonts\\BOD_B.TTF" (normalized: "c:\\windows\\fonts\\bod_b.ttf")

Region:
	              id = 968
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_bi.ttf"
	        filename = "\\Windows\\Fonts\\BOD_BI.TTF" (normalized: "c:\\windows\\fonts\\bod_bi.ttf")

Region:
	              id = 969
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_bi.ttf"
	        filename = "\\Windows\\Fonts\\BOD_BI.TTF" (normalized: "c:\\windows\\fonts\\bod_bi.ttf")

Region:
	              id = 970
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_blai.ttf"
	        filename = "\\Windows\\Fonts\\BOD_BLAI.TTF" (normalized: "c:\\windows\\fonts\\bod_blai.ttf")

Region:
	              id = 971
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_blai.ttf"
	        filename = "\\Windows\\Fonts\\BOD_BLAI.TTF" (normalized: "c:\\windows\\fonts\\bod_blai.ttf")

Region:
	              id = 972
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_blar.ttf"
	        filename = "\\Windows\\Fonts\\BOD_BLAR.TTF" (normalized: "c:\\windows\\fonts\\bod_blar.ttf")

Region:
	              id = 973
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_blar.ttf"
	        filename = "\\Windows\\Fonts\\BOD_BLAR.TTF" (normalized: "c:\\windows\\fonts\\bod_blar.ttf")

Region:
	              id = 974
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_cb.ttf"
	        filename = "\\Windows\\Fonts\\BOD_CB.TTF" (normalized: "c:\\windows\\fonts\\bod_cb.ttf")

Region:
	              id = 975
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_cb.ttf"
	        filename = "\\Windows\\Fonts\\BOD_CB.TTF" (normalized: "c:\\windows\\fonts\\bod_cb.ttf")

Region:
	              id = 976
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_cbi.ttf"
	        filename = "\\Windows\\Fonts\\BOD_CBI.TTF" (normalized: "c:\\windows\\fonts\\bod_cbi.ttf")

Region:
	              id = 977
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_cbi.ttf"
	        filename = "\\Windows\\Fonts\\BOD_CBI.TTF" (normalized: "c:\\windows\\fonts\\bod_cbi.ttf")

Region:
	              id = 978
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_ci.ttf"
	        filename = "\\Windows\\Fonts\\BOD_CI.TTF" (normalized: "c:\\windows\\fonts\\bod_ci.ttf")

Region:
	              id = 979
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_ci.ttf"
	        filename = "\\Windows\\Fonts\\BOD_CI.TTF" (normalized: "c:\\windows\\fonts\\bod_ci.ttf")

Region:
	              id = 980
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_cr.ttf"
	        filename = "\\Windows\\Fonts\\BOD_CR.TTF" (normalized: "c:\\windows\\fonts\\bod_cr.ttf")

Region:
	              id = 981
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_cr.ttf"
	        filename = "\\Windows\\Fonts\\BOD_CR.TTF" (normalized: "c:\\windows\\fonts\\bod_cr.ttf")

Region:
	              id = 982
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_i.ttf"
	        filename = "\\Windows\\Fonts\\BOD_I.TTF" (normalized: "c:\\windows\\fonts\\bod_i.ttf")

Region:
	              id = 983
	        start_va = 0x3c0000
	          end_va = 0x3d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_i.ttf"
	        filename = "\\Windows\\Fonts\\BOD_I.TTF" (normalized: "c:\\windows\\fonts\\bod_i.ttf")

Region:
	              id = 984
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_pstc.ttf"
	        filename = "\\Windows\\Fonts\\BOD_PSTC.TTF" (normalized: "c:\\windows\\fonts\\bod_pstc.ttf")

Region:
	              id = 985
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_pstc.ttf"
	        filename = "\\Windows\\Fonts\\BOD_PSTC.TTF" (normalized: "c:\\windows\\fonts\\bod_pstc.ttf")

Region:
	              id = 986
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_r.ttf"
	        filename = "\\Windows\\Fonts\\BOD_R.TTF" (normalized: "c:\\windows\\fonts\\bod_r.ttf")

Region:
	              id = 987
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bod_r.ttf"
	        filename = "\\Windows\\Fonts\\BOD_R.TTF" (normalized: "c:\\windows\\fonts\\bod_r.ttf")

Region:
	              id = 988
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bookos.ttf"
	        filename = "\\Windows\\Fonts\\BOOKOS.TTF" (normalized: "c:\\windows\\fonts\\bookos.ttf")

Region:
	              id = 989
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bookos.ttf"
	        filename = "\\Windows\\Fonts\\BOOKOS.TTF" (normalized: "c:\\windows\\fonts\\bookos.ttf")

Region:
	              id = 990
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bookosb.ttf"
	        filename = "\\Windows\\Fonts\\BOOKOSB.TTF" (normalized: "c:\\windows\\fonts\\bookosb.ttf")

Region:
	              id = 991
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bookosb.ttf"
	        filename = "\\Windows\\Fonts\\BOOKOSB.TTF" (normalized: "c:\\windows\\fonts\\bookosb.ttf")

Region:
	              id = 992
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bookosbi.ttf"
	        filename = "\\Windows\\Fonts\\BOOKOSBI.TTF" (normalized: "c:\\windows\\fonts\\bookosbi.ttf")

Region:
	              id = 993
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bookosbi.ttf"
	        filename = "\\Windows\\Fonts\\BOOKOSBI.TTF" (normalized: "c:\\windows\\fonts\\bookosbi.ttf")

Region:
	              id = 994
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bookosi.ttf"
	        filename = "\\Windows\\Fonts\\BOOKOSI.TTF" (normalized: "c:\\windows\\fonts\\bookosi.ttf")

Region:
	              id = 995
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bookosi.ttf"
	        filename = "\\Windows\\Fonts\\BOOKOSI.TTF" (normalized: "c:\\windows\\fonts\\bookosi.ttf")

Region:
	              id = 996
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bradhitc.ttf"
	        filename = "\\Windows\\Fonts\\BRADHITC.TTF" (normalized: "c:\\windows\\fonts\\bradhitc.ttf")

Region:
	              id = 997
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bradhitc.ttf"
	        filename = "\\Windows\\Fonts\\BRADHITC.TTF" (normalized: "c:\\windows\\fonts\\bradhitc.ttf")

Region:
	              id = 998
	        start_va = 0x370000
	          end_va = 0x379fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "britanic.ttf"
	        filename = "\\Windows\\Fonts\\BRITANIC.TTF" (normalized: "c:\\windows\\fonts\\britanic.ttf")

Region:
	              id = 999
	        start_va = 0x370000
	          end_va = 0x379fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "britanic.ttf"
	        filename = "\\Windows\\Fonts\\BRITANIC.TTF" (normalized: "c:\\windows\\fonts\\britanic.ttf")

Region:
	              id = 1000
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "brlnsb.ttf"
	        filename = "\\Windows\\Fonts\\BRLNSB.TTF" (normalized: "c:\\windows\\fonts\\brlnsb.ttf")

Region:
	              id = 1001
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "brlnsb.ttf"
	        filename = "\\Windows\\Fonts\\BRLNSB.TTF" (normalized: "c:\\windows\\fonts\\brlnsb.ttf")

Region:
	              id = 1002
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "brlnsdb.ttf"
	        filename = "\\Windows\\Fonts\\BRLNSDB.TTF" (normalized: "c:\\windows\\fonts\\brlnsdb.ttf")

Region:
	              id = 1003
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "brlnsdb.ttf"
	        filename = "\\Windows\\Fonts\\BRLNSDB.TTF" (normalized: "c:\\windows\\fonts\\brlnsdb.ttf")

Region:
	              id = 1004
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "brlnsr.ttf"
	        filename = "\\Windows\\Fonts\\BRLNSR.TTF" (normalized: "c:\\windows\\fonts\\brlnsr.ttf")

Region:
	              id = 1005
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "brlnsr.ttf"
	        filename = "\\Windows\\Fonts\\BRLNSR.TTF" (normalized: "c:\\windows\\fonts\\brlnsr.ttf")

Region:
	              id = 1006
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "broadw.ttf"
	        filename = "\\Windows\\Fonts\\BROADW.TTF" (normalized: "c:\\windows\\fonts\\broadw.ttf")

Region:
	              id = 1007
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "broadw.ttf"
	        filename = "\\Windows\\Fonts\\BROADW.TTF" (normalized: "c:\\windows\\fonts\\broadw.ttf")

Region:
	              id = 1008
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "brushsci.ttf"
	        filename = "\\Windows\\Fonts\\BRUSHSCI.TTF" (normalized: "c:\\windows\\fonts\\brushsci.ttf")

Region:
	              id = 1009
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "brushsci.ttf"
	        filename = "\\Windows\\Fonts\\BRUSHSCI.TTF" (normalized: "c:\\windows\\fonts\\brushsci.ttf")

Region:
	              id = 1010
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bssym7.ttf"
	        filename = "\\Windows\\Fonts\\BSSYM7.TTF" (normalized: "c:\\windows\\fonts\\bssym7.ttf")

Region:
	              id = 1011
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bssym7.ttf"
	        filename = "\\Windows\\Fonts\\BSSYM7.TTF" (normalized: "c:\\windows\\fonts\\bssym7.ttf")

Region:
	              id = 1012
	        start_va = 0x4470000
	          end_va = 0x4529fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibril.ttf"
	        filename = "\\Windows\\Fonts\\CalibriL.ttf" (normalized: "c:\\windows\\fonts\\calibril.ttf")

Region:
	              id = 1013
	        start_va = 0x4470000
	          end_va = 0x4529fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibril.ttf"
	        filename = "\\Windows\\Fonts\\CalibriL.ttf" (normalized: "c:\\windows\\fonts\\calibril.ttf")

Region:
	              id = 1014
	        start_va = 0x4470000
	          end_va = 0x4544fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibrili.ttf"
	        filename = "\\Windows\\Fonts\\CalibriLI.ttf" (normalized: "c:\\windows\\fonts\\calibrili.ttf")

Region:
	              id = 1015
	        start_va = 0x4470000
	          end_va = 0x4544fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calibrili.ttf"
	        filename = "\\Windows\\Fonts\\CalibriLI.ttf" (normalized: "c:\\windows\\fonts\\calibrili.ttf")

Region:
	              id = 1016
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "califb.ttf"
	        filename = "\\Windows\\Fonts\\CALIFB.TTF" (normalized: "c:\\windows\\fonts\\califb.ttf")

Region:
	              id = 1017
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "califb.ttf"
	        filename = "\\Windows\\Fonts\\CALIFB.TTF" (normalized: "c:\\windows\\fonts\\califb.ttf")

Region:
	              id = 1018
	        start_va = 0x3c0000
	          end_va = 0x3d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "califi.ttf"
	        filename = "\\Windows\\Fonts\\CALIFI.TTF" (normalized: "c:\\windows\\fonts\\califi.ttf")

Region:
	              id = 1019
	        start_va = 0x3c0000
	          end_va = 0x3d8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "califi.ttf"
	        filename = "\\Windows\\Fonts\\CALIFI.TTF" (normalized: "c:\\windows\\fonts\\califi.ttf")

Region:
	              id = 1020
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "califr.ttf"
	        filename = "\\Windows\\Fonts\\CALIFR.TTF" (normalized: "c:\\windows\\fonts\\califr.ttf")

Region:
	              id = 1021
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "califr.ttf"
	        filename = "\\Windows\\Fonts\\CALIFR.TTF" (normalized: "c:\\windows\\fonts\\califr.ttf")

Region:
	              id = 1022
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calist.ttf"
	        filename = "\\Windows\\Fonts\\CALIST.TTF" (normalized: "c:\\windows\\fonts\\calist.ttf")

Region:
	              id = 1023
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calist.ttf"
	        filename = "\\Windows\\Fonts\\CALIST.TTF" (normalized: "c:\\windows\\fonts\\calist.ttf")

Region:
	              id = 1024
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calistb.ttf"
	        filename = "\\Windows\\Fonts\\CALISTB.TTF" (normalized: "c:\\windows\\fonts\\calistb.ttf")

Region:
	              id = 1025
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calistb.ttf"
	        filename = "\\Windows\\Fonts\\CALISTB.TTF" (normalized: "c:\\windows\\fonts\\calistb.ttf")

Region:
	              id = 1026
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calistbi.ttf"
	        filename = "\\Windows\\Fonts\\CALISTBI.TTF" (normalized: "c:\\windows\\fonts\\calistbi.ttf")

Region:
	              id = 1027
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calistbi.ttf"
	        filename = "\\Windows\\Fonts\\CALISTBI.TTF" (normalized: "c:\\windows\\fonts\\calistbi.ttf")

Region:
	              id = 1028
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calisti.ttf"
	        filename = "\\Windows\\Fonts\\CALISTI.TTF" (normalized: "c:\\windows\\fonts\\calisti.ttf")

Region:
	              id = 1029
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "calisti.ttf"
	        filename = "\\Windows\\Fonts\\CALISTI.TTF" (normalized: "c:\\windows\\fonts\\calisti.ttf")

Region:
	              id = 1030
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "castelar.ttf"
	        filename = "\\Windows\\Fonts\\CASTELAR.TTF" (normalized: "c:\\windows\\fonts\\castelar.ttf")

Region:
	              id = 1031
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "castelar.ttf"
	        filename = "\\Windows\\Fonts\\CASTELAR.TTF" (normalized: "c:\\windows\\fonts\\castelar.ttf")

Region:
	              id = 1032
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "censcbk.ttf"
	        filename = "\\Windows\\Fonts\\CENSCBK.TTF" (normalized: "c:\\windows\\fonts\\censcbk.ttf")

Region:
	              id = 1033
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "censcbk.ttf"
	        filename = "\\Windows\\Fonts\\CENSCBK.TTF" (normalized: "c:\\windows\\fonts\\censcbk.ttf")

Region:
	              id = 1034
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "centaur.ttf"
	        filename = "\\Windows\\Fonts\\CENTAUR.TTF" (normalized: "c:\\windows\\fonts\\centaur.ttf")

Region:
	              id = 1035
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "centaur.ttf"
	        filename = "\\Windows\\Fonts\\CENTAUR.TTF" (normalized: "c:\\windows\\fonts\\centaur.ttf")

Region:
	              id = 1036
	        start_va = 0x3c0000
	          end_va = 0x3e8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "century.ttf"
	        filename = "\\Windows\\Fonts\\CENTURY.TTF" (normalized: "c:\\windows\\fonts\\century.ttf")

Region:
	              id = 1037
	        start_va = 0x3c0000
	          end_va = 0x3e8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "century.ttf"
	        filename = "\\Windows\\Fonts\\CENTURY.TTF" (normalized: "c:\\windows\\fonts\\century.ttf")

Region:
	              id = 1038
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "chiller.ttf"
	        filename = "\\Windows\\Fonts\\CHILLER.TTF" (normalized: "c:\\windows\\fonts\\chiller.ttf")

Region:
	              id = 1039
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "chiller.ttf"
	        filename = "\\Windows\\Fonts\\CHILLER.TTF" (normalized: "c:\\windows\\fonts\\chiller.ttf")

Region:
	              id = 1040
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "colonna.ttf"
	        filename = "\\Windows\\Fonts\\COLONNA.TTF" (normalized: "c:\\windows\\fonts\\colonna.ttf")

Region:
	              id = 1041
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "colonna.ttf"
	        filename = "\\Windows\\Fonts\\COLONNA.TTF" (normalized: "c:\\windows\\fonts\\colonna.ttf")

Region:
	              id = 1042
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "coopbl.ttf"
	        filename = "\\Windows\\Fonts\\COOPBL.TTF" (normalized: "c:\\windows\\fonts\\coopbl.ttf")

Region:
	              id = 1043
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "coopbl.ttf"
	        filename = "\\Windows\\Fonts\\COOPBL.TTF" (normalized: "c:\\windows\\fonts\\coopbl.ttf")

Region:
	              id = 1044
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "coprgtb.ttf"
	        filename = "\\Windows\\Fonts\\COPRGTB.TTF" (normalized: "c:\\windows\\fonts\\coprgtb.ttf")

Region:
	              id = 1045
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "coprgtb.ttf"
	        filename = "\\Windows\\Fonts\\COPRGTB.TTF" (normalized: "c:\\windows\\fonts\\coprgtb.ttf")

Region:
	              id = 1046
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "coprgtl.ttf"
	        filename = "\\Windows\\Fonts\\COPRGTL.TTF" (normalized: "c:\\windows\\fonts\\coprgtl.ttf")

Region:
	              id = 1047
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "coprgtl.ttf"
	        filename = "\\Windows\\Fonts\\COPRGTL.TTF" (normalized: "c:\\windows\\fonts\\coprgtl.ttf")

Region:
	              id = 1048
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "curlz___.ttf"
	        filename = "\\Windows\\Fonts\\CURLZ___.TTF" (normalized: "c:\\windows\\fonts\\curlz___.ttf")

Region:
	              id = 1049
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "curlz___.ttf"
	        filename = "\\Windows\\Fonts\\CURLZ___.TTF" (normalized: "c:\\windows\\fonts\\curlz___.ttf")

Region:
	              id = 1050
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "elephnt.ttf"
	        filename = "\\Windows\\Fonts\\ELEPHNT.TTF" (normalized: "c:\\windows\\fonts\\elephnt.ttf")

Region:
	              id = 1051
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "elephnt.ttf"
	        filename = "\\Windows\\Fonts\\ELEPHNT.TTF" (normalized: "c:\\windows\\fonts\\elephnt.ttf")

Region:
	              id = 1052
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "elephnti.ttf"
	        filename = "\\Windows\\Fonts\\ELEPHNTI.TTF" (normalized: "c:\\windows\\fonts\\elephnti.ttf")

Region:
	              id = 1053
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "elephnti.ttf"
	        filename = "\\Windows\\Fonts\\ELEPHNTI.TTF" (normalized: "c:\\windows\\fonts\\elephnti.ttf")

Region:
	              id = 1054
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "engr.ttf"
	        filename = "\\Windows\\Fonts\\ENGR.TTF" (normalized: "c:\\windows\\fonts\\engr.ttf")

Region:
	              id = 1055
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "engr.ttf"
	        filename = "\\Windows\\Fonts\\ENGR.TTF" (normalized: "c:\\windows\\fonts\\engr.ttf")

Region:
	              id = 1056
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "erasbd.ttf"
	        filename = "\\Windows\\Fonts\\ERASBD.TTF" (normalized: "c:\\windows\\fonts\\erasbd.ttf")

Region:
	              id = 1057
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "erasbd.ttf"
	        filename = "\\Windows\\Fonts\\ERASBD.TTF" (normalized: "c:\\windows\\fonts\\erasbd.ttf")

Region:
	              id = 1058
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "erasdemi.ttf"
	        filename = "\\Windows\\Fonts\\ERASDEMI.TTF" (normalized: "c:\\windows\\fonts\\erasdemi.ttf")

Region:
	              id = 1059
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "erasdemi.ttf"
	        filename = "\\Windows\\Fonts\\ERASDEMI.TTF" (normalized: "c:\\windows\\fonts\\erasdemi.ttf")

Region:
	              id = 1060
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "eraslght.ttf"
	        filename = "\\Windows\\Fonts\\ERASLGHT.TTF" (normalized: "c:\\windows\\fonts\\eraslght.ttf")

Region:
	              id = 1061
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "eraslght.ttf"
	        filename = "\\Windows\\Fonts\\ERASLGHT.TTF" (normalized: "c:\\windows\\fonts\\eraslght.ttf")

Region:
	              id = 1062
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "erasmd.ttf"
	        filename = "\\Windows\\Fonts\\ERASMD.TTF" (normalized: "c:\\windows\\fonts\\erasmd.ttf")

Region:
	              id = 1063
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "erasmd.ttf"
	        filename = "\\Windows\\Fonts\\ERASMD.TTF" (normalized: "c:\\windows\\fonts\\erasmd.ttf")

Region:
	              id = 1064
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "felixti.ttf"
	        filename = "\\Windows\\Fonts\\FELIXTI.TTF" (normalized: "c:\\windows\\fonts\\felixti.ttf")

Region:
	              id = 1065
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "felixti.ttf"
	        filename = "\\Windows\\Fonts\\FELIXTI.TTF" (normalized: "c:\\windows\\fonts\\felixti.ttf")

Region:
	              id = 1066
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "forte.ttf"
	        filename = "\\Windows\\Fonts\\FORTE.TTF" (normalized: "c:\\windows\\fonts\\forte.ttf")

Region:
	              id = 1067
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "forte.ttf"
	        filename = "\\Windows\\Fonts\\FORTE.TTF" (normalized: "c:\\windows\\fonts\\forte.ttf")

Region:
	              id = 1068
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frabk.ttf"
	        filename = "\\Windows\\Fonts\\FRABK.TTF" (normalized: "c:\\windows\\fonts\\frabk.ttf")

Region:
	              id = 1069
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frabk.ttf"
	        filename = "\\Windows\\Fonts\\FRABK.TTF" (normalized: "c:\\windows\\fonts\\frabk.ttf")

Region:
	              id = 1070
	        start_va = 0x3c0000
	          end_va = 0x3e9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frabkit.ttf"
	        filename = "\\Windows\\Fonts\\FRABKIT.TTF" (normalized: "c:\\windows\\fonts\\frabkit.ttf")

Region:
	              id = 1071
	        start_va = 0x3c0000
	          end_va = 0x3e9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frabkit.ttf"
	        filename = "\\Windows\\Fonts\\FRABKIT.TTF" (normalized: "c:\\windows\\fonts\\frabkit.ttf")

Region:
	              id = 1072
	        start_va = 0x3c0000
	          end_va = 0x3e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "fradm.ttf"
	        filename = "\\Windows\\Fonts\\FRADM.TTF" (normalized: "c:\\windows\\fonts\\fradm.ttf")

Region:
	              id = 1073
	        start_va = 0x3c0000
	          end_va = 0x3e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "fradm.ttf"
	        filename = "\\Windows\\Fonts\\FRADM.TTF" (normalized: "c:\\windows\\fonts\\fradm.ttf")

Region:
	              id = 1074
	        start_va = 0x3c0000
	          end_va = 0x3dcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "fradmcn.ttf"
	        filename = "\\Windows\\Fonts\\FRADMCN.TTF" (normalized: "c:\\windows\\fonts\\fradmcn.ttf")

Region:
	              id = 1075
	        start_va = 0x3c0000
	          end_va = 0x3dcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "fradmcn.ttf"
	        filename = "\\Windows\\Fonts\\FRADMCN.TTF" (normalized: "c:\\windows\\fonts\\fradmcn.ttf")

Region:
	              id = 1076
	        start_va = 0x3c0000
	          end_va = 0x3e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "fradmit.ttf"
	        filename = "\\Windows\\Fonts\\FRADMIT.TTF" (normalized: "c:\\windows\\fonts\\fradmit.ttf")

Region:
	              id = 1077
	        start_va = 0x3c0000
	          end_va = 0x3e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "fradmit.ttf"
	        filename = "\\Windows\\Fonts\\FRADMIT.TTF" (normalized: "c:\\windows\\fonts\\fradmit.ttf")

Region:
	              id = 1078
	        start_va = 0x3c0000
	          end_va = 0x3e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frahv.ttf"
	        filename = "\\Windows\\Fonts\\FRAHV.TTF" (normalized: "c:\\windows\\fonts\\frahv.ttf")

Region:
	              id = 1079
	        start_va = 0x3c0000
	          end_va = 0x3e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frahv.ttf"
	        filename = "\\Windows\\Fonts\\FRAHV.TTF" (normalized: "c:\\windows\\fonts\\frahv.ttf")

Region:
	              id = 1080
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frahvit.ttf"
	        filename = "\\Windows\\Fonts\\FRAHVIT.TTF" (normalized: "c:\\windows\\fonts\\frahvit.ttf")

Region:
	              id = 1081
	        start_va = 0x3c0000
	          end_va = 0x3e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frahvit.ttf"
	        filename = "\\Windows\\Fonts\\FRAHVIT.TTF" (normalized: "c:\\windows\\fonts\\frahvit.ttf")

Region:
	              id = 1082
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "framdcn.ttf"
	        filename = "\\Windows\\Fonts\\FRAMDCN.TTF" (normalized: "c:\\windows\\fonts\\framdcn.ttf")

Region:
	              id = 1083
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "framdcn.ttf"
	        filename = "\\Windows\\Fonts\\FRAMDCN.TTF" (normalized: "c:\\windows\\fonts\\framdcn.ttf")

Region:
	              id = 1084
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "freescpt.ttf"
	        filename = "\\Windows\\Fonts\\FREESCPT.TTF" (normalized: "c:\\windows\\fonts\\freescpt.ttf")

Region:
	              id = 1085
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "freescpt.ttf"
	        filename = "\\Windows\\Fonts\\FREESCPT.TTF" (normalized: "c:\\windows\\fonts\\freescpt.ttf")

Region:
	              id = 1086
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frscript.ttf"
	        filename = "\\Windows\\Fonts\\FRSCRIPT.TTF" (normalized: "c:\\windows\\fonts\\frscript.ttf")

Region:
	              id = 1087
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "frscript.ttf"
	        filename = "\\Windows\\Fonts\\FRSCRIPT.TTF" (normalized: "c:\\windows\\fonts\\frscript.ttf")

Region:
	              id = 1088
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ftltlt.ttf"
	        filename = "\\Windows\\Fonts\\FTLTLT.TTF" (normalized: "c:\\windows\\fonts\\ftltlt.ttf")

Region:
	              id = 1089
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ftltlt.ttf"
	        filename = "\\Windows\\Fonts\\FTLTLT.TTF" (normalized: "c:\\windows\\fonts\\ftltlt.ttf")

Region:
	              id = 1090
	        start_va = 0x3c0000
	          end_va = 0x3f3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gadugi.ttf"
	        filename = "\\Windows\\Fonts\\GADUGI.TTF" (normalized: "c:\\windows\\fonts\\gadugi.ttf")

Region:
	              id = 1091
	        start_va = 0x3c0000
	          end_va = 0x3f3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gadugi.ttf"
	        filename = "\\Windows\\Fonts\\GADUGI.TTF" (normalized: "c:\\windows\\fonts\\gadugi.ttf")

Region:
	              id = 1092
	        start_va = 0x3c0000
	          end_va = 0x3f3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gadugib.ttf"
	        filename = "\\Windows\\Fonts\\GADUGIB.TTF" (normalized: "c:\\windows\\fonts\\gadugib.ttf")

Region:
	              id = 1093
	        start_va = 0x3c0000
	          end_va = 0x3f3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gadugib.ttf"
	        filename = "\\Windows\\Fonts\\GADUGIB.TTF" (normalized: "c:\\windows\\fonts\\gadugib.ttf")

Region:
	              id = 1094
	        start_va = 0x3c0000
	          end_va = 0x3f0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gara.ttf"
	        filename = "\\Windows\\Fonts\\GARA.TTF" (normalized: "c:\\windows\\fonts\\gara.ttf")

Region:
	              id = 1095
	        start_va = 0x3c0000
	          end_va = 0x3f0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gara.ttf"
	        filename = "\\Windows\\Fonts\\GARA.TTF" (normalized: "c:\\windows\\fonts\\gara.ttf")

Region:
	              id = 1096
	        start_va = 0x3c0000
	          end_va = 0x3f0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "garabd.ttf"
	        filename = "\\Windows\\Fonts\\GARABD.TTF" (normalized: "c:\\windows\\fonts\\garabd.ttf")

Region:
	              id = 1097
	        start_va = 0x3c0000
	          end_va = 0x3f0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "garabd.ttf"
	        filename = "\\Windows\\Fonts\\GARABD.TTF" (normalized: "c:\\windows\\fonts\\garabd.ttf")

Region:
	              id = 1098
	        start_va = 0x3c0000
	          end_va = 0x3eefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "garait.ttf"
	        filename = "\\Windows\\Fonts\\GARAIT.TTF" (normalized: "c:\\windows\\fonts\\garait.ttf")

Region:
	              id = 1099
	        start_va = 0x3c0000
	          end_va = 0x3eefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "garait.ttf"
	        filename = "\\Windows\\Fonts\\GARAIT.TTF" (normalized: "c:\\windows\\fonts\\garait.ttf")

Region:
	              id = 1100
	        start_va = 0x3c0000
	          end_va = 0x3e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gigi.ttf"
	        filename = "\\Windows\\Fonts\\GIGI.TTF" (normalized: "c:\\windows\\fonts\\gigi.ttf")

Region:
	              id = 1101
	        start_va = 0x3c0000
	          end_va = 0x3e2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gigi.ttf"
	        filename = "\\Windows\\Fonts\\GIGI.TTF" (normalized: "c:\\windows\\fonts\\gigi.ttf")

Region:
	              id = 1102
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gil_____.ttf"
	        filename = "\\Windows\\Fonts\\GIL_____.TTF" (normalized: "c:\\windows\\fonts\\gil_____.ttf")

Region:
	              id = 1103
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gil_____.ttf"
	        filename = "\\Windows\\Fonts\\GIL_____.TTF" (normalized: "c:\\windows\\fonts\\gil_____.ttf")

Region:
	              id = 1104
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gilb____.ttf"
	        filename = "\\Windows\\Fonts\\GILB____.TTF" (normalized: "c:\\windows\\fonts\\gilb____.ttf")

Region:
	              id = 1105
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gilb____.ttf"
	        filename = "\\Windows\\Fonts\\GILB____.TTF" (normalized: "c:\\windows\\fonts\\gilb____.ttf")

Region:
	              id = 1106
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gilbi___.ttf"
	        filename = "\\Windows\\Fonts\\GILBI___.TTF" (normalized: "c:\\windows\\fonts\\gilbi___.ttf")

Region:
	              id = 1107
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gilbi___.ttf"
	        filename = "\\Windows\\Fonts\\GILBI___.TTF" (normalized: "c:\\windows\\fonts\\gilbi___.ttf")

Region:
	              id = 1108
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gilc____.ttf"
	        filename = "\\Windows\\Fonts\\GILC____.TTF" (normalized: "c:\\windows\\fonts\\gilc____.ttf")

Region:
	              id = 1109
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gilc____.ttf"
	        filename = "\\Windows\\Fonts\\GILC____.TTF" (normalized: "c:\\windows\\fonts\\gilc____.ttf")

Region:
	              id = 1110
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gili____.ttf"
	        filename = "\\Windows\\Fonts\\GILI____.TTF" (normalized: "c:\\windows\\fonts\\gili____.ttf")

Region:
	              id = 1111
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gili____.ttf"
	        filename = "\\Windows\\Fonts\\GILI____.TTF" (normalized: "c:\\windows\\fonts\\gili____.ttf")

Region:
	              id = 1112
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gillubcd.ttf"
	        filename = "\\Windows\\Fonts\\GILLUBCD.TTF" (normalized: "c:\\windows\\fonts\\gillubcd.ttf")

Region:
	              id = 1113
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gillubcd.ttf"
	        filename = "\\Windows\\Fonts\\GILLUBCD.TTF" (normalized: "c:\\windows\\fonts\\gillubcd.ttf")

Region:
	              id = 1114
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gilsanub.ttf"
	        filename = "\\Windows\\Fonts\\GILSANUB.TTF" (normalized: "c:\\windows\\fonts\\gilsanub.ttf")

Region:
	              id = 1115
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gilsanub.ttf"
	        filename = "\\Windows\\Fonts\\GILSANUB.TTF" (normalized: "c:\\windows\\fonts\\gilsanub.ttf")

Region:
	              id = 1116
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "glecb.ttf"
	        filename = "\\Windows\\Fonts\\GLECB.TTF" (normalized: "c:\\windows\\fonts\\glecb.ttf")

Region:
	              id = 1117
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "glecb.ttf"
	        filename = "\\Windows\\Fonts\\GLECB.TTF" (normalized: "c:\\windows\\fonts\\glecb.ttf")

Region:
	              id = 1118
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "glsnecb.ttf"
	        filename = "\\Windows\\Fonts\\GLSNECB.TTF" (normalized: "c:\\windows\\fonts\\glsnecb.ttf")

Region:
	              id = 1119
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "glsnecb.ttf"
	        filename = "\\Windows\\Fonts\\GLSNECB.TTF" (normalized: "c:\\windows\\fonts\\glsnecb.ttf")

Region:
	              id = 1120
	        start_va = 0x3c0000
	          end_va = 0x3e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gothic.ttf"
	        filename = "\\Windows\\Fonts\\GOTHIC.TTF" (normalized: "c:\\windows\\fonts\\gothic.ttf")

Region:
	              id = 1121
	        start_va = 0x3c0000
	          end_va = 0x3e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gothic.ttf"
	        filename = "\\Windows\\Fonts\\GOTHIC.TTF" (normalized: "c:\\windows\\fonts\\gothic.ttf")

Region:
	              id = 1122
	        start_va = 0x3c0000
	          end_va = 0x3dffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gothicb.ttf"
	        filename = "\\Windows\\Fonts\\GOTHICB.TTF" (normalized: "c:\\windows\\fonts\\gothicb.ttf")

Region:
	              id = 1123
	        start_va = 0x3c0000
	          end_va = 0x3dffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gothicb.ttf"
	        filename = "\\Windows\\Fonts\\GOTHICB.TTF" (normalized: "c:\\windows\\fonts\\gothicb.ttf")

Region:
	              id = 1124
	        start_va = 0x3c0000
	          end_va = 0x3e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gothicbi.ttf"
	        filename = "\\Windows\\Fonts\\GOTHICBI.TTF" (normalized: "c:\\windows\\fonts\\gothicbi.ttf")

Region:
	              id = 1125
	        start_va = 0x3c0000
	          end_va = 0x3e1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gothicbi.ttf"
	        filename = "\\Windows\\Fonts\\GOTHICBI.TTF" (normalized: "c:\\windows\\fonts\\gothicbi.ttf")

Region:
	              id = 1126
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gothici.ttf"
	        filename = "\\Windows\\Fonts\\GOTHICI.TTF" (normalized: "c:\\windows\\fonts\\gothici.ttf")

Region:
	              id = 1127
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gothici.ttf"
	        filename = "\\Windows\\Fonts\\GOTHICI.TTF" (normalized: "c:\\windows\\fonts\\gothici.ttf")

Region:
	              id = 1128
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "goudos.ttf"
	        filename = "\\Windows\\Fonts\\GOUDOS.TTF" (normalized: "c:\\windows\\fonts\\goudos.ttf")

Region:
	              id = 1129
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "goudos.ttf"
	        filename = "\\Windows\\Fonts\\GOUDOS.TTF" (normalized: "c:\\windows\\fonts\\goudos.ttf")

Region:
	              id = 1130
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "goudosb.ttf"
	        filename = "\\Windows\\Fonts\\GOUDOSB.TTF" (normalized: "c:\\windows\\fonts\\goudosb.ttf")

Region:
	              id = 1131
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "goudosb.ttf"
	        filename = "\\Windows\\Fonts\\GOUDOSB.TTF" (normalized: "c:\\windows\\fonts\\goudosb.ttf")

Region:
	              id = 1132
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "goudosi.ttf"
	        filename = "\\Windows\\Fonts\\GOUDOSI.TTF" (normalized: "c:\\windows\\fonts\\goudosi.ttf")

Region:
	              id = 1133
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "goudosi.ttf"
	        filename = "\\Windows\\Fonts\\GOUDOSI.TTF" (normalized: "c:\\windows\\fonts\\goudosi.ttf")

Region:
	              id = 1134
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "goudysto.ttf"
	        filename = "\\Windows\\Fonts\\GOUDYSTO.TTF" (normalized: "c:\\windows\\fonts\\goudysto.ttf")

Region:
	              id = 1135
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "goudysto.ttf"
	        filename = "\\Windows\\Fonts\\GOUDYSTO.TTF" (normalized: "c:\\windows\\fonts\\goudysto.ttf")

Region:
	              id = 1136
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "harlowsi.ttf"
	        filename = "\\Windows\\Fonts\\HARLOWSI.TTF" (normalized: "c:\\windows\\fonts\\harlowsi.ttf")

Region:
	              id = 1137
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "harlowsi.ttf"
	        filename = "\\Windows\\Fonts\\HARLOWSI.TTF" (normalized: "c:\\windows\\fonts\\harlowsi.ttf")

Region:
	              id = 1138
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "harngton.ttf"
	        filename = "\\Windows\\Fonts\\HARNGTON.TTF" (normalized: "c:\\windows\\fonts\\harngton.ttf")

Region:
	              id = 1139
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "harngton.ttf"
	        filename = "\\Windows\\Fonts\\HARNGTON.TTF" (normalized: "c:\\windows\\fonts\\harngton.ttf")

Region:
	              id = 1140
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "hatten.ttf"
	        filename = "\\Windows\\Fonts\\HATTEN.TTF" (normalized: "c:\\windows\\fonts\\hatten.ttf")

Region:
	              id = 1141
	        start_va = 0x3c0000
	          end_va = 0x3dafff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "hatten.ttf"
	        filename = "\\Windows\\Fonts\\HATTEN.TTF" (normalized: "c:\\windows\\fonts\\hatten.ttf")

Region:
	              id = 1142
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "htowert.ttf"
	        filename = "\\Windows\\Fonts\\HTOWERT.TTF" (normalized: "c:\\windows\\fonts\\htowert.ttf")

Region:
	              id = 1143
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "htowert.ttf"
	        filename = "\\Windows\\Fonts\\HTOWERT.TTF" (normalized: "c:\\windows\\fonts\\htowert.ttf")

Region:
	              id = 1144
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "htowerti.ttf"
	        filename = "\\Windows\\Fonts\\HTOWERTI.TTF" (normalized: "c:\\windows\\fonts\\htowerti.ttf")

Region:
	              id = 1145
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "htowerti.ttf"
	        filename = "\\Windows\\Fonts\\HTOWERTI.TTF" (normalized: "c:\\windows\\fonts\\htowerti.ttf")

Region:
	              id = 1146
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "imprisha.ttf"
	        filename = "\\Windows\\Fonts\\IMPRISHA.TTF" (normalized: "c:\\windows\\fonts\\imprisha.ttf")

Region:
	              id = 1147
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "imprisha.ttf"
	        filename = "\\Windows\\Fonts\\IMPRISHA.TTF" (normalized: "c:\\windows\\fonts\\imprisha.ttf")

Region:
	              id = 1148
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "infroman.ttf"
	        filename = "\\Windows\\Fonts\\INFROMAN.TTF" (normalized: "c:\\windows\\fonts\\infroman.ttf")

Region:
	              id = 1149
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "infroman.ttf"
	        filename = "\\Windows\\Fonts\\INFROMAN.TTF" (normalized: "c:\\windows\\fonts\\infroman.ttf")

Region:
	              id = 1150
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "itcblkad.ttf"
	        filename = "\\Windows\\Fonts\\ITCBLKAD.TTF" (normalized: "c:\\windows\\fonts\\itcblkad.ttf")

Region:
	              id = 1151
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "itcblkad.ttf"
	        filename = "\\Windows\\Fonts\\ITCBLKAD.TTF" (normalized: "c:\\windows\\fonts\\itcblkad.ttf")

Region:
	              id = 1152
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "itcedscr.ttf"
	        filename = "\\Windows\\Fonts\\ITCEDSCR.TTF" (normalized: "c:\\windows\\fonts\\itcedscr.ttf")

Region:
	              id = 1153
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "itcedscr.ttf"
	        filename = "\\Windows\\Fonts\\ITCEDSCR.TTF" (normalized: "c:\\windows\\fonts\\itcedscr.ttf")

Region:
	              id = 1154
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "itckrist.ttf"
	        filename = "\\Windows\\Fonts\\ITCKRIST.TTF" (normalized: "c:\\windows\\fonts\\itckrist.ttf")

Region:
	              id = 1155
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "itckrist.ttf"
	        filename = "\\Windows\\Fonts\\ITCKRIST.TTF" (normalized: "c:\\windows\\fonts\\itckrist.ttf")

Region:
	              id = 1156
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "jokerman.ttf"
	        filename = "\\Windows\\Fonts\\JOKERMAN.TTF" (normalized: "c:\\windows\\fonts\\jokerman.ttf")

Region:
	              id = 1157
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "jokerman.ttf"
	        filename = "\\Windows\\Fonts\\JOKERMAN.TTF" (normalized: "c:\\windows\\fonts\\jokerman.ttf")

Region:
	              id = 1158
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "juice___.ttf"
	        filename = "\\Windows\\Fonts\\JUICE___.TTF" (normalized: "c:\\windows\\fonts\\juice___.ttf")

Region:
	              id = 1159
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "juice___.ttf"
	        filename = "\\Windows\\Fonts\\JUICE___.TTF" (normalized: "c:\\windows\\fonts\\juice___.ttf")

Region:
	              id = 1160
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kunstler.ttf"
	        filename = "\\Windows\\Fonts\\KUNSTLER.TTF" (normalized: "c:\\windows\\fonts\\kunstler.ttf")

Region:
	              id = 1161
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kunstler.ttf"
	        filename = "\\Windows\\Fonts\\KUNSTLER.TTF" (normalized: "c:\\windows\\fonts\\kunstler.ttf")

Region:
	              id = 1162
	        start_va = 0x370000
	          end_va = 0x37afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "latinwd.ttf"
	        filename = "\\Windows\\Fonts\\LATINWD.TTF" (normalized: "c:\\windows\\fonts\\latinwd.ttf")

Region:
	              id = 1163
	        start_va = 0x370000
	          end_va = 0x37afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "latinwd.ttf"
	        filename = "\\Windows\\Fonts\\LATINWD.TTF" (normalized: "c:\\windows\\fonts\\latinwd.ttf")

Region:
	              id = 1164
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lbrite.ttf"
	        filename = "\\Windows\\Fonts\\LBRITE.TTF" (normalized: "c:\\windows\\fonts\\lbrite.ttf")

Region:
	              id = 1165
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lbrite.ttf"
	        filename = "\\Windows\\Fonts\\LBRITE.TTF" (normalized: "c:\\windows\\fonts\\lbrite.ttf")

Region:
	              id = 1166
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lbrited.ttf"
	        filename = "\\Windows\\Fonts\\LBRITED.TTF" (normalized: "c:\\windows\\fonts\\lbrited.ttf")

Region:
	              id = 1167
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lbrited.ttf"
	        filename = "\\Windows\\Fonts\\LBRITED.TTF" (normalized: "c:\\windows\\fonts\\lbrited.ttf")

Region:
	              id = 1168
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lbritedi.ttf"
	        filename = "\\Windows\\Fonts\\LBRITEDI.TTF" (normalized: "c:\\windows\\fonts\\lbritedi.ttf")

Region:
	              id = 1169
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lbritedi.ttf"
	        filename = "\\Windows\\Fonts\\LBRITEDI.TTF" (normalized: "c:\\windows\\fonts\\lbritedi.ttf")

Region:
	              id = 1170
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lbritei.ttf"
	        filename = "\\Windows\\Fonts\\LBRITEI.TTF" (normalized: "c:\\windows\\fonts\\lbritei.ttf")

Region:
	              id = 1171
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lbritei.ttf"
	        filename = "\\Windows\\Fonts\\LBRITEI.TTF" (normalized: "c:\\windows\\fonts\\lbritei.ttf")

Region:
	              id = 1172
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lcallig.ttf"
	        filename = "\\Windows\\Fonts\\LCALLIG.TTF" (normalized: "c:\\windows\\fonts\\lcallig.ttf")

Region:
	              id = 1173
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lcallig.ttf"
	        filename = "\\Windows\\Fonts\\LCALLIG.TTF" (normalized: "c:\\windows\\fonts\\lcallig.ttf")

Region:
	              id = 1174
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lfax.ttf"
	        filename = "\\Windows\\Fonts\\LFAX.TTF" (normalized: "c:\\windows\\fonts\\lfax.ttf")

Region:
	              id = 1175
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lfax.ttf"
	        filename = "\\Windows\\Fonts\\LFAX.TTF" (normalized: "c:\\windows\\fonts\\lfax.ttf")

Region:
	              id = 1176
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lfaxd.ttf"
	        filename = "\\Windows\\Fonts\\LFAXD.TTF" (normalized: "c:\\windows\\fonts\\lfaxd.ttf")

Region:
	              id = 1177
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lfaxd.ttf"
	        filename = "\\Windows\\Fonts\\LFAXD.TTF" (normalized: "c:\\windows\\fonts\\lfaxd.ttf")

Region:
	              id = 1178
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lfaxdi.ttf"
	        filename = "\\Windows\\Fonts\\LFAXDI.TTF" (normalized: "c:\\windows\\fonts\\lfaxdi.ttf")

Region:
	              id = 1179
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lfaxdi.ttf"
	        filename = "\\Windows\\Fonts\\LFAXDI.TTF" (normalized: "c:\\windows\\fonts\\lfaxdi.ttf")

Region:
	              id = 1180
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lfaxi.ttf"
	        filename = "\\Windows\\Fonts\\LFAXI.TTF" (normalized: "c:\\windows\\fonts\\lfaxi.ttf")

Region:
	              id = 1181
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lfaxi.ttf"
	        filename = "\\Windows\\Fonts\\LFAXI.TTF" (normalized: "c:\\windows\\fonts\\lfaxi.ttf")

Region:
	              id = 1182
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lhandw.ttf"
	        filename = "\\Windows\\Fonts\\LHANDW.TTF" (normalized: "c:\\windows\\fonts\\lhandw.ttf")

Region:
	              id = 1183
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lhandw.ttf"
	        filename = "\\Windows\\Fonts\\LHANDW.TTF" (normalized: "c:\\windows\\fonts\\lhandw.ttf")

Region:
	              id = 1184
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lsans.ttf"
	        filename = "\\Windows\\Fonts\\LSANS.TTF" (normalized: "c:\\windows\\fonts\\lsans.ttf")

Region:
	              id = 1185
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lsans.ttf"
	        filename = "\\Windows\\Fonts\\LSANS.TTF" (normalized: "c:\\windows\\fonts\\lsans.ttf")

Region:
	              id = 1186
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lsansd.ttf"
	        filename = "\\Windows\\Fonts\\LSANSD.TTF" (normalized: "c:\\windows\\fonts\\lsansd.ttf")

Region:
	              id = 1187
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lsansd.ttf"
	        filename = "\\Windows\\Fonts\\LSANSD.TTF" (normalized: "c:\\windows\\fonts\\lsansd.ttf")

Region:
	              id = 1188
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lsansdi.ttf"
	        filename = "\\Windows\\Fonts\\LSANSDI.TTF" (normalized: "c:\\windows\\fonts\\lsansdi.ttf")

Region:
	              id = 1189
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lsansdi.ttf"
	        filename = "\\Windows\\Fonts\\LSANSDI.TTF" (normalized: "c:\\windows\\fonts\\lsansdi.ttf")

Region:
	              id = 1190
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lsansi.ttf"
	        filename = "\\Windows\\Fonts\\LSANSI.TTF" (normalized: "c:\\windows\\fonts\\lsansi.ttf")

Region:
	              id = 1191
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "lsansi.ttf"
	        filename = "\\Windows\\Fonts\\LSANSI.TTF" (normalized: "c:\\windows\\fonts\\lsansi.ttf")

Region:
	              id = 1192
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ltype.ttf"
	        filename = "\\Windows\\Fonts\\LTYPE.TTF" (normalized: "c:\\windows\\fonts\\ltype.ttf")

Region:
	              id = 1193
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ltype.ttf"
	        filename = "\\Windows\\Fonts\\LTYPE.TTF" (normalized: "c:\\windows\\fonts\\ltype.ttf")

Region:
	              id = 1194
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ltypeb.ttf"
	        filename = "\\Windows\\Fonts\\LTYPEB.TTF" (normalized: "c:\\windows\\fonts\\ltypeb.ttf")

Region:
	              id = 1195
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ltypeb.ttf"
	        filename = "\\Windows\\Fonts\\LTYPEB.TTF" (normalized: "c:\\windows\\fonts\\ltypeb.ttf")

Region:
	              id = 1196
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ltypebo.ttf"
	        filename = "\\Windows\\Fonts\\LTYPEBO.TTF" (normalized: "c:\\windows\\fonts\\ltypebo.ttf")

Region:
	              id = 1197
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ltypebo.ttf"
	        filename = "\\Windows\\Fonts\\LTYPEBO.TTF" (normalized: "c:\\windows\\fonts\\ltypebo.ttf")

Region:
	              id = 1198
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ltypeo.ttf"
	        filename = "\\Windows\\Fonts\\LTYPEO.TTF" (normalized: "c:\\windows\\fonts\\ltypeo.ttf")

Region:
	              id = 1199
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ltypeo.ttf"
	        filename = "\\Windows\\Fonts\\LTYPEO.TTF" (normalized: "c:\\windows\\fonts\\ltypeo.ttf")

Region:
	              id = 1200
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "magnetob.ttf"
	        filename = "\\Windows\\Fonts\\MAGNETOB.TTF" (normalized: "c:\\windows\\fonts\\magnetob.ttf")

Region:
	              id = 1201
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "magnetob.ttf"
	        filename = "\\Windows\\Fonts\\MAGNETOB.TTF" (normalized: "c:\\windows\\fonts\\magnetob.ttf")

Region:
	              id = 1202
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "maian.ttf"
	        filename = "\\Windows\\Fonts\\MAIAN.TTF" (normalized: "c:\\windows\\fonts\\maian.ttf")

Region:
	              id = 1203
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "maian.ttf"
	        filename = "\\Windows\\Fonts\\MAIAN.TTF" (normalized: "c:\\windows\\fonts\\maian.ttf")

Region:
	              id = 1204
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "maturasc.ttf"
	        filename = "\\Windows\\Fonts\\MATURASC.TTF" (normalized: "c:\\windows\\fonts\\maturasc.ttf")

Region:
	              id = 1205
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "maturasc.ttf"
	        filename = "\\Windows\\Fonts\\MATURASC.TTF" (normalized: "c:\\windows\\fonts\\maturasc.ttf")

Region:
	              id = 1206
	        start_va = 0x3c0000
	          end_va = 0x3eefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mistral.ttf"
	        filename = "\\Windows\\Fonts\\MISTRAL.TTF" (normalized: "c:\\windows\\fonts\\mistral.ttf")

Region:
	              id = 1207
	        start_va = 0x3c0000
	          end_va = 0x3eefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mistral.ttf"
	        filename = "\\Windows\\Fonts\\MISTRAL.TTF" (normalized: "c:\\windows\\fonts\\mistral.ttf")

Region:
	              id = 1208
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mod20.ttf"
	        filename = "\\Windows\\Fonts\\MOD20.TTF" (normalized: "c:\\windows\\fonts\\mod20.ttf")

Region:
	              id = 1209
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mod20.ttf"
	        filename = "\\Windows\\Fonts\\MOD20.TTF" (normalized: "c:\\windows\\fonts\\mod20.ttf")

Region:
	              id = 1210
	        start_va = 0x7dc0000
	          end_va = 0x9210fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msjh.ttc"
	        filename = "\\Windows\\Fonts\\MSJH.TTC" (normalized: "c:\\windows\\fonts\\msjh.ttc")

Region:
	              id = 1211
	        start_va = 0x7dc0000
	          end_va = 0x9210fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msjh.ttc"
	        filename = "\\Windows\\Fonts\\MSJH.TTC" (normalized: "c:\\windows\\fonts\\msjh.ttc")

Region:
	              id = 1212
	        start_va = 0x7dc0000
	          end_va = 0x9210fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msjh.ttc"
	        filename = "\\Windows\\Fonts\\MSJH.TTC" (normalized: "c:\\windows\\fonts\\msjh.ttc")

Region:
	              id = 1213
	        start_va = 0x5060000
	          end_va = 0x5e0dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msjhbd.ttc"
	        filename = "\\Windows\\Fonts\\MSJHBD.TTC" (normalized: "c:\\windows\\fonts\\msjhbd.ttc")

Region:
	              id = 1214
	        start_va = 0x5060000
	          end_va = 0x5e0dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msjhbd.ttc"
	        filename = "\\Windows\\Fonts\\MSJHBD.TTC" (normalized: "c:\\windows\\fonts\\msjhbd.ttc")

Region:
	              id = 1215
	        start_va = 0x5060000
	          end_va = 0x5e0dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msjhbd.ttc"
	        filename = "\\Windows\\Fonts\\MSJHBD.TTC" (normalized: "c:\\windows\\fonts\\msjhbd.ttc")

Region:
	              id = 1216
	        start_va = 0x3c0000
	          end_va = 0x3f8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msuighub.ttf"
	        filename = "\\Windows\\Fonts\\MSUIGHUB.TTF" (normalized: "c:\\windows\\fonts\\msuighub.ttf")

Region:
	              id = 1217
	        start_va = 0x3c0000
	          end_va = 0x3f8fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msuighub.ttf"
	        filename = "\\Windows\\Fonts\\MSUIGHUB.TTF" (normalized: "c:\\windows\\fonts\\msuighub.ttf")

Region:
	              id = 1218
	        start_va = 0x7dc0000
	          end_va = 0x924bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyh.ttc"
	        filename = "\\Windows\\Fonts\\MSYH.TTC" (normalized: "c:\\windows\\fonts\\msyh.ttc")

Region:
	              id = 1219
	        start_va = 0x7dc0000
	          end_va = 0x924bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyh.ttc"
	        filename = "\\Windows\\Fonts\\MSYH.TTC" (normalized: "c:\\windows\\fonts\\msyh.ttc")

Region:
	              id = 1220
	        start_va = 0x7dc0000
	          end_va = 0x924bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyh.ttc"
	        filename = "\\Windows\\Fonts\\MSYH.TTC" (normalized: "c:\\windows\\fonts\\msyh.ttc")

Region:
	              id = 1221
	        start_va = 0x5060000
	          end_va = 0x5e17fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyhbd.ttc"
	        filename = "\\Windows\\Fonts\\MSYHBD.TTC" (normalized: "c:\\windows\\fonts\\msyhbd.ttc")

Region:
	              id = 1222
	        start_va = 0x5060000
	          end_va = 0x5e17fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyhbd.ttc"
	        filename = "\\Windows\\Fonts\\MSYHBD.TTC" (normalized: "c:\\windows\\fonts\\msyhbd.ttc")

Region:
	              id = 1223
	        start_va = 0x5060000
	          end_va = 0x5e17fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msyhbd.ttc"
	        filename = "\\Windows\\Fonts\\MSYHBD.TTC" (normalized: "c:\\windows\\fonts\\msyhbd.ttc")

Region:
	              id = 1224
	        start_va = 0x3c0000
	          end_va = 0x3e6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mtcorsva.ttf"
	        filename = "\\Windows\\Fonts\\MTCORSVA.TTF" (normalized: "c:\\windows\\fonts\\mtcorsva.ttf")

Region:
	              id = 1225
	        start_va = 0x3c0000
	          end_va = 0x3e6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mtcorsva.ttf"
	        filename = "\\Windows\\Fonts\\MTCORSVA.TTF" (normalized: "c:\\windows\\fonts\\mtcorsva.ttf")

Region:
	              id = 1226
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "niageng.ttf"
	        filename = "\\Windows\\Fonts\\NIAGENG.TTF" (normalized: "c:\\windows\\fonts\\niageng.ttf")

Region:
	              id = 1227
	        start_va = 0x3c0000
	          end_va = 0x3d7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "niageng.ttf"
	        filename = "\\Windows\\Fonts\\NIAGENG.TTF" (normalized: "c:\\windows\\fonts\\niageng.ttf")

Region:
	              id = 1228
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "niagsol.ttf"
	        filename = "\\Windows\\Fonts\\NIAGSOL.TTF" (normalized: "c:\\windows\\fonts\\niagsol.ttf")

Region:
	              id = 1229
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "niagsol.ttf"
	        filename = "\\Windows\\Fonts\\NIAGSOL.TTF" (normalized: "c:\\windows\\fonts\\niagsol.ttf")

Region:
	              id = 1230
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ocraext.ttf"
	        filename = "\\Windows\\Fonts\\OCRAEXT.TTF" (normalized: "c:\\windows\\fonts\\ocraext.ttf")

Region:
	              id = 1231
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ocraext.ttf"
	        filename = "\\Windows\\Fonts\\OCRAEXT.TTF" (normalized: "c:\\windows\\fonts\\ocraext.ttf")

Region:
	              id = 1232
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "oldengl.ttf"
	        filename = "\\Windows\\Fonts\\OLDENGL.TTF" (normalized: "c:\\windows\\fonts\\oldengl.ttf")

Region:
	              id = 1233
	        start_va = 0x3c0000
	          end_va = 0x3d6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "oldengl.ttf"
	        filename = "\\Windows\\Fonts\\OLDENGL.TTF" (normalized: "c:\\windows\\fonts\\oldengl.ttf")

Region:
	              id = 1234
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "onyx.ttf"
	        filename = "\\Windows\\Fonts\\ONYX.TTF" (normalized: "c:\\windows\\fonts\\onyx.ttf")

Region:
	              id = 1235
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "onyx.ttf"
	        filename = "\\Windows\\Fonts\\ONYX.TTF" (normalized: "c:\\windows\\fonts\\onyx.ttf")

Region:
	              id = 1236
	        start_va = 0x370000
	          end_va = 0x374fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "outlook.ttf"
	        filename = "\\Windows\\Fonts\\OUTLOOK.TTF" (normalized: "c:\\windows\\fonts\\outlook.ttf")

Region:
	              id = 1237
	        start_va = 0x370000
	          end_va = 0x374fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "outlook.ttf"
	        filename = "\\Windows\\Fonts\\OUTLOOK.TTF" (normalized: "c:\\windows\\fonts\\outlook.ttf")

Region:
	              id = 1238
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "palscri.ttf"
	        filename = "\\Windows\\Fonts\\PALSCRI.TTF" (normalized: "c:\\windows\\fonts\\palscri.ttf")

Region:
	              id = 1239
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "palscri.ttf"
	        filename = "\\Windows\\Fonts\\PALSCRI.TTF" (normalized: "c:\\windows\\fonts\\palscri.ttf")

Region:
	              id = 1240
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "papyrus.ttf"
	        filename = "\\Windows\\Fonts\\PAPYRUS.TTF" (normalized: "c:\\windows\\fonts\\papyrus.ttf")

Region:
	              id = 1241
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "papyrus.ttf"
	        filename = "\\Windows\\Fonts\\PAPYRUS.TTF" (normalized: "c:\\windows\\fonts\\papyrus.ttf")

Region:
	              id = 1242
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "parchm.ttf"
	        filename = "\\Windows\\Fonts\\PARCHM.TTF" (normalized: "c:\\windows\\fonts\\parchm.ttf")

Region:
	              id = 1243
	        start_va = 0x3c0000
	          end_va = 0x3e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "parchm.ttf"
	        filename = "\\Windows\\Fonts\\PARCHM.TTF" (normalized: "c:\\windows\\fonts\\parchm.ttf")

Region:
	              id = 1244
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "per_____.ttf"
	        filename = "\\Windows\\Fonts\\PER_____.TTF" (normalized: "c:\\windows\\fonts\\per_____.ttf")

Region:
	              id = 1245
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "per_____.ttf"
	        filename = "\\Windows\\Fonts\\PER_____.TTF" (normalized: "c:\\windows\\fonts\\per_____.ttf")

Region:
	              id = 1246
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "perb____.ttf"
	        filename = "\\Windows\\Fonts\\PERB____.TTF" (normalized: "c:\\windows\\fonts\\perb____.ttf")

Region:
	              id = 1247
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "perb____.ttf"
	        filename = "\\Windows\\Fonts\\PERB____.TTF" (normalized: "c:\\windows\\fonts\\perb____.ttf")

Region:
	              id = 1248
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "perbi___.ttf"
	        filename = "\\Windows\\Fonts\\PERBI___.TTF" (normalized: "c:\\windows\\fonts\\perbi___.ttf")

Region:
	              id = 1249
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "perbi___.ttf"
	        filename = "\\Windows\\Fonts\\PERBI___.TTF" (normalized: "c:\\windows\\fonts\\perbi___.ttf")

Region:
	              id = 1250
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "peri____.ttf"
	        filename = "\\Windows\\Fonts\\PERI____.TTF" (normalized: "c:\\windows\\fonts\\peri____.ttf")

Region:
	              id = 1251
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "peri____.ttf"
	        filename = "\\Windows\\Fonts\\PERI____.TTF" (normalized: "c:\\windows\\fonts\\peri____.ttf")

Region:
	              id = 1252
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "pertibd.ttf"
	        filename = "\\Windows\\Fonts\\PERTIBD.TTF" (normalized: "c:\\windows\\fonts\\pertibd.ttf")

Region:
	              id = 1253
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "pertibd.ttf"
	        filename = "\\Windows\\Fonts\\PERTIBD.TTF" (normalized: "c:\\windows\\fonts\\pertibd.ttf")

Region:
	              id = 1254
	        start_va = 0x370000
	          end_va = 0x37afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "pertili.ttf"
	        filename = "\\Windows\\Fonts\\PERTILI.TTF" (normalized: "c:\\windows\\fonts\\pertili.ttf")

Region:
	              id = 1255
	        start_va = 0x370000
	          end_va = 0x37afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "pertili.ttf"
	        filename = "\\Windows\\Fonts\\PERTILI.TTF" (normalized: "c:\\windows\\fonts\\pertili.ttf")

Region:
	              id = 1256
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "playbill.ttf"
	        filename = "\\Windows\\Fonts\\PLAYBILL.TTF" (normalized: "c:\\windows\\fonts\\playbill.ttf")

Region:
	              id = 1257
	        start_va = 0x370000
	          end_va = 0x37bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "playbill.ttf"
	        filename = "\\Windows\\Fonts\\PLAYBILL.TTF" (normalized: "c:\\windows\\fonts\\playbill.ttf")

Region:
	              id = 1258
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "poorich.ttf"
	        filename = "\\Windows\\Fonts\\POORICH.TTF" (normalized: "c:\\windows\\fonts\\poorich.ttf")

Region:
	              id = 1259
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "poorich.ttf"
	        filename = "\\Windows\\Fonts\\POORICH.TTF" (normalized: "c:\\windows\\fonts\\poorich.ttf")

Region:
	              id = 1260
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "pristina.ttf"
	        filename = "\\Windows\\Fonts\\PRISTINA.TTF" (normalized: "c:\\windows\\fonts\\pristina.ttf")

Region:
	              id = 1261
	        start_va = 0x3c0000
	          end_va = 0x3d4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "pristina.ttf"
	        filename = "\\Windows\\Fonts\\PRISTINA.TTF" (normalized: "c:\\windows\\fonts\\pristina.ttf")

Region:
	              id = 1262
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rage.ttf"
	        filename = "\\Windows\\Fonts\\RAGE.TTF" (normalized: "c:\\windows\\fonts\\rage.ttf")

Region:
	              id = 1263
	        start_va = 0x3c0000
	          end_va = 0x3e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rage.ttf"
	        filename = "\\Windows\\Fonts\\RAGE.TTF" (normalized: "c:\\windows\\fonts\\rage.ttf")

Region:
	              id = 1264
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ravie.ttf"
	        filename = "\\Windows\\Fonts\\RAVIE.TTF" (normalized: "c:\\windows\\fonts\\ravie.ttf")

Region:
	              id = 1265
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ravie.ttf"
	        filename = "\\Windows\\Fonts\\RAVIE.TTF" (normalized: "c:\\windows\\fonts\\ravie.ttf")

Region:
	              id = 1266
	        start_va = 0x3c0000
	          end_va = 0x3f5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "refsan.ttf"
	        filename = "\\Windows\\Fonts\\REFSAN.TTF" (normalized: "c:\\windows\\fonts\\refsan.ttf")

Region:
	              id = 1267
	        start_va = 0x3c0000
	          end_va = 0x3f5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "refsan.ttf"
	        filename = "\\Windows\\Fonts\\REFSAN.TTF" (normalized: "c:\\windows\\fonts\\refsan.ttf")

Region:
	              id = 1268
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "refspcl.ttf"
	        filename = "\\Windows\\Fonts\\REFSPCL.TTF" (normalized: "c:\\windows\\fonts\\refspcl.ttf")

Region:
	              id = 1269
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "refspcl.ttf"
	        filename = "\\Windows\\Fonts\\REFSPCL.TTF" (normalized: "c:\\windows\\fonts\\refspcl.ttf")

Region:
	              id = 1270
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rocc____.ttf"
	        filename = "\\Windows\\Fonts\\ROCC____.TTF" (normalized: "c:\\windows\\fonts\\rocc____.ttf")

Region:
	              id = 1271
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rocc____.ttf"
	        filename = "\\Windows\\Fonts\\ROCC____.TTF" (normalized: "c:\\windows\\fonts\\rocc____.ttf")

Region:
	              id = 1272
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "roccb___.ttf"
	        filename = "\\Windows\\Fonts\\ROCCB___.TTF" (normalized: "c:\\windows\\fonts\\roccb___.ttf")

Region:
	              id = 1273
	        start_va = 0x370000
	          end_va = 0x37efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "roccb___.ttf"
	        filename = "\\Windows\\Fonts\\ROCCB___.TTF" (normalized: "c:\\windows\\fonts\\roccb___.ttf")

Region:
	              id = 1274
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rock.ttf"
	        filename = "\\Windows\\Fonts\\ROCK.TTF" (normalized: "c:\\windows\\fonts\\rock.ttf")

Region:
	              id = 1275
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rock.ttf"
	        filename = "\\Windows\\Fonts\\ROCK.TTF" (normalized: "c:\\windows\\fonts\\rock.ttf")

Region:
	              id = 1276
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rockb.ttf"
	        filename = "\\Windows\\Fonts\\ROCKB.TTF" (normalized: "c:\\windows\\fonts\\rockb.ttf")

Region:
	              id = 1277
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rockb.ttf"
	        filename = "\\Windows\\Fonts\\ROCKB.TTF" (normalized: "c:\\windows\\fonts\\rockb.ttf")

Region:
	              id = 1278
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rockbi.ttf"
	        filename = "\\Windows\\Fonts\\ROCKBI.TTF" (normalized: "c:\\windows\\fonts\\rockbi.ttf")

Region:
	              id = 1279
	        start_va = 0x3c0000
	          end_va = 0x3d1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rockbi.ttf"
	        filename = "\\Windows\\Fonts\\ROCKBI.TTF" (normalized: "c:\\windows\\fonts\\rockbi.ttf")

Region:
	              id = 1280
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rockeb.ttf"
	        filename = "\\Windows\\Fonts\\ROCKEB.TTF" (normalized: "c:\\windows\\fonts\\rockeb.ttf")

Region:
	              id = 1281
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rockeb.ttf"
	        filename = "\\Windows\\Fonts\\ROCKEB.TTF" (normalized: "c:\\windows\\fonts\\rockeb.ttf")

Region:
	              id = 1282
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rocki.ttf"
	        filename = "\\Windows\\Fonts\\ROCKI.TTF" (normalized: "c:\\windows\\fonts\\rocki.ttf")

Region:
	              id = 1283
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "rocki.ttf"
	        filename = "\\Windows\\Fonts\\ROCKI.TTF" (normalized: "c:\\windows\\fonts\\rocki.ttf")

Region:
	              id = 1284
	        start_va = 0x3c0000
	          end_va = 0x3e9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "schlbkb.ttf"
	        filename = "\\Windows\\Fonts\\SCHLBKB.TTF" (normalized: "c:\\windows\\fonts\\schlbkb.ttf")

Region:
	              id = 1285
	        start_va = 0x3c0000
	          end_va = 0x3e9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "schlbkb.ttf"
	        filename = "\\Windows\\Fonts\\SCHLBKB.TTF" (normalized: "c:\\windows\\fonts\\schlbkb.ttf")

Region:
	              id = 1286
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "schlbkbi.ttf"
	        filename = "\\Windows\\Fonts\\SCHLBKBI.TTF" (normalized: "c:\\windows\\fonts\\schlbkbi.ttf")

Region:
	              id = 1287
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "schlbkbi.ttf"
	        filename = "\\Windows\\Fonts\\SCHLBKBI.TTF" (normalized: "c:\\windows\\fonts\\schlbkbi.ttf")

Region:
	              id = 1288
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "schlbki.ttf"
	        filename = "\\Windows\\Fonts\\SCHLBKI.TTF" (normalized: "c:\\windows\\fonts\\schlbki.ttf")

Region:
	              id = 1289
	        start_va = 0x3c0000
	          end_va = 0x3e7fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "schlbki.ttf"
	        filename = "\\Windows\\Fonts\\SCHLBKI.TTF" (normalized: "c:\\windows\\fonts\\schlbki.ttf")

Region:
	              id = 1290
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "scriptbl.ttf"
	        filename = "\\Windows\\Fonts\\SCRIPTBL.TTF" (normalized: "c:\\windows\\fonts\\scriptbl.ttf")

Region:
	              id = 1291
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "scriptbl.ttf"
	        filename = "\\Windows\\Fonts\\SCRIPTBL.TTF" (normalized: "c:\\windows\\fonts\\scriptbl.ttf")

Region:
	              id = 1292
	        start_va = 0x4470000
	          end_va = 0x4507fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeuisl.ttf"
	        filename = "\\Windows\\Fonts\\SEGOEUISL.TTF" (normalized: "c:\\windows\\fonts\\segoeuisl.ttf")

Region:
	              id = 1293
	        start_va = 0x4470000
	          end_va = 0x4507fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "segoeuisl.ttf"
	        filename = "\\Windows\\Fonts\\SEGOEUISL.TTF" (normalized: "c:\\windows\\fonts\\segoeuisl.ttf")

Region:
	              id = 1294
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "showg.ttf"
	        filename = "\\Windows\\Fonts\\SHOWG.TTF" (normalized: "c:\\windows\\fonts\\showg.ttf")

Region:
	              id = 1295
	        start_va = 0x370000
	          end_va = 0x37cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "showg.ttf"
	        filename = "\\Windows\\Fonts\\SHOWG.TTF" (normalized: "c:\\windows\\fonts\\showg.ttf")

Region:
	              id = 1296
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "snap____.ttf"
	        filename = "\\Windows\\Fonts\\SNAP____.TTF" (normalized: "c:\\windows\\fonts\\snap____.ttf")

Region:
	              id = 1297
	        start_va = 0x370000
	          end_va = 0x37ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "snap____.ttf"
	        filename = "\\Windows\\Fonts\\SNAP____.TTF" (normalized: "c:\\windows\\fonts\\snap____.ttf")

Region:
	              id = 1298
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "stencil.ttf"
	        filename = "\\Windows\\Fonts\\STENCIL.TTF" (normalized: "c:\\windows\\fonts\\stencil.ttf")

Region:
	              id = 1299
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "stencil.ttf"
	        filename = "\\Windows\\Fonts\\STENCIL.TTF" (normalized: "c:\\windows\\fonts\\stencil.ttf")

Region:
	              id = 1300
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tcb_____.ttf"
	        filename = "\\Windows\\Fonts\\TCB_____.TTF" (normalized: "c:\\windows\\fonts\\tcb_____.ttf")

Region:
	              id = 1301
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tcb_____.ttf"
	        filename = "\\Windows\\Fonts\\TCB_____.TTF" (normalized: "c:\\windows\\fonts\\tcb_____.ttf")

Region:
	              id = 1302
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tcbi____.ttf"
	        filename = "\\Windows\\Fonts\\TCBI____.TTF" (normalized: "c:\\windows\\fonts\\tcbi____.ttf")

Region:
	              id = 1303
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tcbi____.ttf"
	        filename = "\\Windows\\Fonts\\TCBI____.TTF" (normalized: "c:\\windows\\fonts\\tcbi____.ttf")

Region:
	              id = 1304
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tccb____.ttf"
	        filename = "\\Windows\\Fonts\\TCCB____.TTF" (normalized: "c:\\windows\\fonts\\tccb____.ttf")

Region:
	              id = 1305
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tccb____.ttf"
	        filename = "\\Windows\\Fonts\\TCCB____.TTF" (normalized: "c:\\windows\\fonts\\tccb____.ttf")

Region:
	              id = 1306
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tcceb.ttf"
	        filename = "\\Windows\\Fonts\\TCCEB.TTF" (normalized: "c:\\windows\\fonts\\tcceb.ttf")

Region:
	              id = 1307
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tcceb.ttf"
	        filename = "\\Windows\\Fonts\\TCCEB.TTF" (normalized: "c:\\windows\\fonts\\tcceb.ttf")

Region:
	              id = 1308
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tccm____.ttf"
	        filename = "\\Windows\\Fonts\\TCCM____.TTF" (normalized: "c:\\windows\\fonts\\tccm____.ttf")

Region:
	              id = 1309
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tccm____.ttf"
	        filename = "\\Windows\\Fonts\\TCCM____.TTF" (normalized: "c:\\windows\\fonts\\tccm____.ttf")

Region:
	              id = 1310
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tcm_____.ttf"
	        filename = "\\Windows\\Fonts\\TCM_____.TTF" (normalized: "c:\\windows\\fonts\\tcm_____.ttf")

Region:
	              id = 1311
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tcm_____.ttf"
	        filename = "\\Windows\\Fonts\\TCM_____.TTF" (normalized: "c:\\windows\\fonts\\tcm_____.ttf")

Region:
	              id = 1312
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tcmi____.ttf"
	        filename = "\\Windows\\Fonts\\TCMI____.TTF" (normalized: "c:\\windows\\fonts\\tcmi____.ttf")

Region:
	              id = 1313
	        start_va = 0x3c0000
	          end_va = 0x3d3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tcmi____.ttf"
	        filename = "\\Windows\\Fonts\\TCMI____.TTF" (normalized: "c:\\windows\\fonts\\tcmi____.ttf")

Region:
	              id = 1314
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tempsitc.ttf"
	        filename = "\\Windows\\Fonts\\TEMPSITC.TTF" (normalized: "c:\\windows\\fonts\\tempsitc.ttf")

Region:
	              id = 1315
	        start_va = 0x3c0000
	          end_va = 0x3d2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tempsitc.ttf"
	        filename = "\\Windows\\Fonts\\TEMPSITC.TTF" (normalized: "c:\\windows\\fonts\\tempsitc.ttf")

Region:
	              id = 1316
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vineritc.ttf"
	        filename = "\\Windows\\Fonts\\VINERITC.TTF" (normalized: "c:\\windows\\fonts\\vineritc.ttf")

Region:
	              id = 1317
	        start_va = 0x3c0000
	          end_va = 0x3d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vineritc.ttf"
	        filename = "\\Windows\\Fonts\\VINERITC.TTF" (normalized: "c:\\windows\\fonts\\vineritc.ttf")

Region:
	              id = 1318
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vivaldii.ttf"
	        filename = "\\Windows\\Fonts\\VIVALDII.TTF" (normalized: "c:\\windows\\fonts\\vivaldii.ttf")

Region:
	              id = 1319
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vivaldii.ttf"
	        filename = "\\Windows\\Fonts\\VIVALDII.TTF" (normalized: "c:\\windows\\fonts\\vivaldii.ttf")

Region:
	              id = 1320
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vladimir.ttf"
	        filename = "\\Windows\\Fonts\\VLADIMIR.TTF" (normalized: "c:\\windows\\fonts\\vladimir.ttf")

Region:
	              id = 1321
	        start_va = 0x370000
	          end_va = 0x37dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vladimir.ttf"
	        filename = "\\Windows\\Fonts\\VLADIMIR.TTF" (normalized: "c:\\windows\\fonts\\vladimir.ttf")

Region:
	              id = 1322
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wingdng2.ttf"
	        filename = "\\Windows\\Fonts\\WINGDNG2.TTF" (normalized: "c:\\windows\\fonts\\wingdng2.ttf")

Region:
	              id = 1323
	        start_va = 0x3c0000
	          end_va = 0x3d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wingdng2.ttf"
	        filename = "\\Windows\\Fonts\\WINGDNG2.TTF" (normalized: "c:\\windows\\fonts\\wingdng2.ttf")

Region:
	              id = 1324
	        start_va = 0x370000
	          end_va = 0x378fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wingdng3.ttf"
	        filename = "\\Windows\\Fonts\\WINGDNG3.TTF" (normalized: "c:\\windows\\fonts\\wingdng3.ttf")

Region:
	              id = 1325
	        start_va = 0x370000
	          end_va = 0x378fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wingdng3.ttf"
	        filename = "\\Windows\\Fonts\\WINGDNG3.TTF" (normalized: "c:\\windows\\fonts\\wingdng3.ttf")

Region:
	              id = 1326
	        start_va = 0x370000
	          end_va = 0x371fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mtextra.ttf"
	        filename = "\\Windows\\Fonts\\MTEXTRA.TTF" (normalized: "c:\\windows\\fonts\\mtextra.ttf")

Region:
	              id = 1327
	        start_va = 0x370000
	          end_va = 0x371fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mtextra.ttf"
	        filename = "\\Windows\\Fonts\\MTEXTRA.TTF" (normalized: "c:\\windows\\fonts\\mtextra.ttf")

Region:
	              id = 1328
	        start_va = 0x360000
	          end_va = 0x37bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gdipfontcachev1.dat"
	        filename = "\\Users\\kEecfMwgj\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\gdipfontcachev1.dat")

Region:
	              id = 1329
	        start_va = 0x690000
	          end_va = 0x6dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 1330
	        start_va = 0x5060000
	          end_va = 0x598ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "staticcache.dat"
	        filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")

Region:
	              id = 1331
	        start_va = 0x6de60000
	          end_va = 0x6e041fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.visualbasic.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\a891970b44db9e340c3ef3efa95b793c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\a891970b44db9e340c3ef3efa95b793c\\microsoft.visualbasic.ni.dll")

Region:
	              id = 1332
	        start_va = 0x360000
	          end_va = 0x36ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000360000"
	        filename = ""

Region:
	              id = 1333
	        start_va = 0x370000
	          end_va = 0x376fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000370000"
	        filename = ""

Region:
	              id = 1334
	        start_va = 0x44b0000
	          end_va = 0x44effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000044b0000"
	        filename = ""

Region:
	              id = 1335
	        start_va = 0x59a0000
	          end_va = 0x59dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000059a0000"
	        filename = ""

Region:
	              id = 1336
	        start_va = 0x5a70000
	          end_va = 0x5b6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a70000"
	        filename = ""

Region:
	              id = 1337
	        start_va = 0x5c50000
	          end_va = 0x5d4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005c50000"
	        filename = ""

Region:
	              id = 1338
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 1339
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 1340
	        start_va = 0x6d0b0000
	          end_va = 0x6de50fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.data.entity.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data.Entity\\2617d639f859d0dc0093286c72e64bf7\\System.Data.Entity.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.data.entity\\2617d639f859d0dc0093286c72e64bf7\\system.data.entity.ni.dll")

Region:
	              id = 1341
	        start_va = 0x44f0000
	          end_va = 0x4551fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mscorrc.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll")

Region:
	              id = 1342
	        start_va = 0x3c0000
	          end_va = 0x3cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003c0000"
	        filename = ""

Region:
	              id = 1343
	        start_va = 0x4a90000
	          end_va = 0x4b0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a90000"
	        filename = ""

Region:
	              id = 1344
	        start_va = 0x5d50000
	          end_va = 0x5e4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d50000"
	        filename = ""

Region:
	              id = 1345
	        start_va = 0x6cfb0000
	          end_va = 0x6d0aafff
	       monitored = 0
	     entry_point = 0x6cfc17e1
	     region_type = mapped_file
	            name = "windowscodecs.dll"
	        filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll")

Region:
	              id = 1346
	        start_va = 0x4f80000
	          end_va = 0x4fe8fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f80000"
	        filename = ""

Region:
	              id = 1347
	        start_va = 0x59e0000
	          end_va = 0x5a47fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000059e0000"
	        filename = ""

Region:
	              id = 1348
	        start_va = 0x3d0000
	          end_va = 0x3dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 1349
	        start_va = 0x3e0000
	          end_va = 0x3effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 1350
	        start_va = 0x3f0000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003f0000"
	        filename = ""

Region:
	              id = 1351
	        start_va = 0x3e0000
	          end_va = 0x3effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 1352
	        start_va = 0x3f0000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003f0000"
	        filename = ""

Region:
	              id = 1353
	        start_va = 0x450000
	          end_va = 0x45ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 1354
	        start_va = 0x460000
	          end_va = 0x46ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 1355
	        start_va = 0x570000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 1356
	        start_va = 0x580000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 1357
	        start_va = 0x690000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 1358
	        start_va = 0x6a0000
	          end_va = 0x6dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006a0000"
	        filename = ""

Region:
	              id = 1359
	        start_va = 0x730000
	          end_va = 0x73ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 1360
	        start_va = 0x740000
	          end_va = 0x74ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000740000"
	        filename = ""

Region:
	              id = 1361
	        start_va = 0x960000
	          end_va = 0x96ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000960000"
	        filename = ""

Region:
	              id = 1362
	        start_va = 0x970000
	          end_va = 0x97ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000970000"
	        filename = ""

Region:
	              id = 1363
	        start_va = 0x980000
	          end_va = 0x98ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000980000"
	        filename = ""

Region:
	              id = 1364
	        start_va = 0x990000
	          end_va = 0x99ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000990000"
	        filename = ""

Region:
	              id = 1365
	        start_va = 0x9a0000
	          end_va = 0x9affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000009a0000"
	        filename = ""

Region:
	              id = 1366
	        start_va = 0x21c0000
	          end_va = 0x21cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021c0000"
	        filename = ""

Region:
	              id = 1367
	        start_va = 0x21d0000
	          end_va = 0x21dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021d0000"
	        filename = ""

Region:
	              id = 1368
	        start_va = 0x21e0000
	          end_va = 0x21effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021e0000"
	        filename = ""

Region:
	              id = 1369
	        start_va = 0x21f0000
	          end_va = 0x21fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021f0000"
	        filename = ""

Region:
	              id = 1370
	        start_va = 0x4320000
	          end_va = 0x432ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004320000"
	        filename = ""

Region:
	              id = 1371
	        start_va = 0x3e0000
	          end_va = 0x3effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 1372
	        start_va = 0x3f0000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003f0000"
	        filename = ""

Region:
	              id = 1373
	        start_va = 0x450000
	          end_va = 0x45ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 1374
	        start_va = 0x460000
	          end_va = 0x46ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 1375
	        start_va = 0x570000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 1376
	        start_va = 0x580000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 1377
	        start_va = 0x690000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 1378
	        start_va = 0x730000
	          end_va = 0x73ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 1379
	        start_va = 0x740000
	          end_va = 0x74ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000740000"
	        filename = ""

Region:
	              id = 1380
	        start_va = 0x960000
	          end_va = 0x96ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000960000"
	        filename = ""

Region:
	              id = 1381
	        start_va = 0x970000
	          end_va = 0x97ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000970000"
	        filename = ""

Region:
	              id = 1382
	        start_va = 0x980000
	          end_va = 0x98ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000980000"
	        filename = ""

Region:
	              id = 1383
	        start_va = 0x990000
	          end_va = 0x99ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000990000"
	        filename = ""

Region:
	              id = 1384
	        start_va = 0x9a0000
	          end_va = 0x9affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000009a0000"
	        filename = ""

Region:
	              id = 1385
	        start_va = 0x21c0000
	          end_va = 0x21cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021c0000"
	        filename = ""

Region:
	              id = 1386
	        start_va = 0x3e0000
	          end_va = 0x3effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 1387
	        start_va = 0x960000
	          end_va = 0x99bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000960000"
	        filename = ""

Region:
	              id = 1388
	        start_va = 0x3e0000
	          end_va = 0x3effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 1389
	        start_va = 0x3e0000
	          end_va = 0x3effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 1390
	        start_va = 0x3e0000
	          end_va = 0x3effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 1391
	        start_va = 0x5e50000
	          end_va = 0x5e8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e50000"
	        filename = ""

Region:
	              id = 1392
	        start_va = 0x7df0000
	          end_va = 0x7eeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007df0000"
	        filename = ""

Region:
	              id = 1393
	        start_va = 0x73f80000
	          end_va = 0x74074fff
	       monitored = 0
	     entry_point = 0x73f90d9e
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")

Region:
	              id = 1394
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 1395
	        start_va = 0x3e0000
	          end_va = 0x3e1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003e0000"
	        filename = ""

Region:
	              id = 1396
	        start_va = 0x744d0000
	          end_va = 0x7466dfff
	       monitored = 0
	     entry_point = 0x744fe6b5
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")

Region:
	              id = 1397
	        start_va = 0x3f0000
	          end_va = 0x3f0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "windowsshell.manifest"
	        filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")

Region:
	              id = 1398
	        start_va = 0x450000
	          end_va = 0x451fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000450000"
	        filename = ""

Region:
	              id = 1399
	        start_va = 0x740d0000
	          end_va = 0x7411bfff
	       monitored = 0
	     entry_point = 0x740d2c14
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 1400
	        start_va = 0x3f0000
	          end_va = 0x3f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003f0000"
	        filename = ""

Region:
	              id = 1401
	        start_va = 0x76530000
	          end_va = 0x765b2fff
	       monitored = 0
	     entry_point = 0x765323d2
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 1402
	        start_va = 0x460000
	          end_va = 0x460fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000460000"
	        filename = ""

Region:
	              id = 1403
	        start_va = 0x746b0000
	          end_va = 0x7512ffff
	       monitored = 0
	     entry_point = 0x746b6b95
	     region_type = mapped_file
	            name = "ieframe.dll"
	        filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll")

Region:
	              id = 1404
	        start_va = 0x76ca0000
	          end_va = 0x76ca4fff
	       monitored = 0
	     entry_point = 0x76ca1438
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 1405
	        start_va = 0x74670000
	          end_va = 0x746abfff
	       monitored = 0
	     entry_point = 0x74673089
	     region_type = mapped_file
	            name = "oleacc.dll"
	        filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll")

Region:
	              id = 1406
	        start_va = 0x76e50000
	          end_va = 0x7704afff
	       monitored = 0
	     entry_point = 0x76e522d9
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")

Region:
	              id = 1407
	        start_va = 0x570000
	          end_va = 0x570fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "oleaccrc.dll"
	        filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll")

Region:
	              id = 1408
	        start_va = 0x580000
	          end_va = 0x581fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000580000"
	        filename = ""

Region:
	              id = 1409
	        start_va = 0x690000
	          end_va = 0x690fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 1410
	        start_va = 0x75470000
	          end_va = 0x755a5fff
	       monitored = 0
	     entry_point = 0x75471b35
	     region_type = mapped_file
	            name = "urlmon.dll"
	        filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")

Region:
	              id = 1411
	        start_va = 0x765c0000
	          end_va = 0x766b4fff
	       monitored = 0
	     entry_point = 0x765c1865
	     region_type = mapped_file
	            name = "wininet.dll"
	        filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")

Region:
	              id = 1412
	        start_va = 0x768b0000
	          end_va = 0x769d0fff
	       monitored = 0
	     entry_point = 0x768b158e
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 1413
	        start_va = 0x766c0000
	          end_va = 0x766cbfff
	       monitored = 0
	     entry_point = 0x766c238e
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 1414
	        start_va = 0x5e90000
	          end_va = 0x5f8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e90000"
	        filename = ""

Region:
	              id = 1415
	        start_va = 0x76cb0000
	          end_va = 0x76e4cfff
	       monitored = 0
	     entry_point = 0x76cb17e7
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")

Region:
	              id = 1416
	        start_va = 0x76240000
	          end_va = 0x76266fff
	       monitored = 0
	     entry_point = 0x762458b9
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 1417
	        start_va = 0x773c0000
	          end_va = 0x773d1fff
	       monitored = 0
	     entry_point = 0x773c1441
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")

Region:
	              id = 1418
	        start_va = 0x730000
	          end_va = 0x73cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "setupapi.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui")

Region:
	              id = 1419
	        start_va = 0x74490000
	          end_va = 0x744b0fff
	       monitored = 0
	     entry_point = 0x7449145e
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")

Region:
	              id = 1420
	        start_va = 0x77130000
	          end_va = 0x77174fff
	       monitored = 0
	     entry_point = 0x771311e1
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")

Region:
	              id = 1421
	        start_va = 0x740000
	          end_va = 0x743fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cversions.1.db"
	        filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")

Region:
	              id = 1422
	        start_va = 0x21c0000
	          end_va = 0x21d6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db"
	        filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db")

Region:
	              id = 1423
	        start_va = 0x9a0000
	          end_va = 0x9a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000009a0000"
	        filename = ""

Region:
	              id = 1424
	        start_va = 0x740000
	          end_va = 0x743fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1425
	        start_va = 0x4470000
	          end_va = 0x449ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db")

Region:
	              id = 1426
	        start_va = 0x21e0000
	          end_va = 0x21e3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1427
	        start_va = 0x5b70000
	          end_va = 0x5bd5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")

Region:
	              id = 1428
	        start_va = 0x4320000
	          end_va = 0x432dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "propsys.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui")

Region:
	              id = 1429
	        start_va = 0x44a0000
	          end_va = 0x44a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000044a0000"
	        filename = ""

Region:
	              id = 1430
	        start_va = 0x4570000
	          end_va = 0x457ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004570000"
	        filename = ""

Region:
	              id = 1431
	        start_va = 0x4580000
	          end_va = 0x458ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004580000"
	        filename = ""

Region:
	              id = 1449
	        start_va = 0x6ce80000
	          end_va = 0x6cfaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.management.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll")

Region:
	              id = 1490
	        start_va = 0x4590000
	          end_va = 0x459ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004590000"
	        filename = ""

Region:
	              id = 1495
	        start_va = 0x45a0000
	          end_va = 0x45affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045a0000"
	        filename = ""

Region:
	              id = 1498
	        start_va = 0x45b0000
	          end_va = 0x45bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045b0000"
	        filename = ""

Region:
	              id = 1499
	        start_va = 0x4570000
	          end_va = 0x457ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004570000"
	        filename = ""

Region:
	              id = 1536
	        start_va = 0x7e80000
	          end_va = 0x7ebffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007e80000"
	        filename = ""

Region:
	              id = 1537
	        start_va = 0x7fe0000
	          end_va = 0x80dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007fe0000"
	        filename = ""

Region:
	              id = 1538
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 1539
	        start_va = 0x7ef50000
	          end_va = 0x7ef9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef50000"
	        filename = ""

Region:
	              id = 1540
	        start_va = 0x7ef40000
	          end_va = 0x7ef4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef40000"
	        filename = ""

Region:
	              id = 1541
	        start_va = 0x74300000
	          end_va = 0x7430dfff
	       monitored = 0
	     entry_point = 0x74301235
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 1545
	        start_va = 0x7ef0000
	          end_va = 0x7f2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007ef0000"
	        filename = ""

Region:
	              id = 1546
	        start_va = 0x80e0000
	          end_va = 0x81dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000080e0000"
	        filename = ""

Region:
	              id = 1547
	        start_va = 0x7ef3d000
	          end_va = 0x7ef3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef3d000"
	        filename = ""

Region:
	              id = 1551
	        start_va = 0x703f0000
	          end_va = 0x70409fff
	       monitored = 0
	     entry_point = 0x704003d0
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll")

Region:
	              id = 1552
	        start_va = 0x6ce10000
	          end_va = 0x6ce70fff
	       monitored = 0
	     entry_point = 0x6ce4bf40
	     region_type = mapped_file
	            name = "wbemcomn2.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn2.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn2.dll")

Region:
	              id = 1553
	        start_va = 0x76200000
	          end_va = 0x76234fff
	       monitored = 0
	     entry_point = 0x7620145d
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1554
	        start_va = 0x774b0000
	          end_va = 0x774b5fff
	       monitored = 0
	     entry_point = 0x774b1782
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 1555
	        start_va = 0x7fa0000
	          end_va = 0x7fdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007fa0000"
	        filename = ""

Region:
	              id = 1556
	        start_va = 0x8260000
	          end_va = 0x835ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008260000"
	        filename = ""

Region:
	              id = 1557
	        start_va = 0x7ef3a000
	          end_va = 0x7ef3cfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef3a000"
	        filename = ""

Region:
	              id = 1558
	        start_va = 0x703c0000
	          end_va = 0x703cafff
	       monitored = 0
	     entry_point = 0x703c52a0
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 1559
	        start_va = 0x70390000
	          end_va = 0x703b0fff
	       monitored = 1
	     entry_point = 0x703998e0
	     region_type = mapped_file
	            name = "wminet_utils.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll")

Region:
	              id = 1570
	        start_va = 0x4570000
	          end_va = 0x457ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004570000"
	        filename = ""

Region:
	              id = 1571
	        start_va = 0x4580000
	          end_va = 0x458ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004580000"
	        filename = ""

Region:
	              id = 1572
	        start_va = 0x4580000
	          end_va = 0x458ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004580000"
	        filename = ""

Region:
	              id = 1573
	        start_va = 0x4580000
	          end_va = 0x458ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004580000"
	        filename = ""

Region:
	              id = 2023
	        start_va = 0x70380000
	          end_va = 0x7038efff
	       monitored = 0
	     entry_point = 0x703893d0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 2025
	        start_va = 0x6ccd0000
	          end_va = 0x6cd75fff
	       monitored = 0
	     entry_point = 0x6cd3a2f0
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 2026
	        start_va = 0x6ccb0000
	          end_va = 0x6ccc7fff
	       monitored = 0
	     entry_point = 0x6ccb1335
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll")

Region:
	              id = 2040
	        start_va = 0x5c10000
	          end_va = 0x5c4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005c10000"
	        filename = ""

Region:
	              id = 2041
	        start_va = 0x8220000
	          end_va = 0x831ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008220000"
	        filename = ""

Region:
	              id = 2042
	        start_va = 0x7e30000
	          end_va = 0x7e6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007e30000"
	        filename = ""

Region:
	              id = 2043
	        start_va = 0x8340000
	          end_va = 0x843ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008340000"
	        filename = ""

Region:
	              id = 2044
	        start_va = 0x7ef37000
	          end_va = 0x7ef39fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef37000"
	        filename = ""

Region:
	              id = 2047
	        start_va = 0x4580000
	          end_va = 0x4582fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004580000"
	        filename = ""

Region:
	              id = 2048
	        start_va = 0x4580000
	          end_va = 0x458ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004580000"
	        filename = ""

Region:
	              id = 2049
	        start_va = 0x4590000
	          end_va = 0x459ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004590000"
	        filename = ""

Region:
	              id = 2050
	        start_va = 0x45a0000
	          end_va = 0x45affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045a0000"
	        filename = ""

Region:
	              id = 2117
	        start_va = 0x5f90000
	          end_va = 0x5fcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005f90000"
	        filename = ""

Region:
	              id = 2118
	        start_va = 0x85a0000
	          end_va = 0x869ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000085a0000"
	        filename = ""

Region:
	              id = 2119
	        start_va = 0x7ef34000
	          end_va = 0x7ef36fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef34000"
	        filename = ""


Thread:
	id = 1
	os_tid = 0xf48

	[0064.032] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
	[0066.670] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x56e620 | out: phkResult=0x56e620*=0x0) returned 0x2
	[0066.670] RegCloseKey (hKey=0x80000002) returned 0x0
	[0066.676] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x56e8a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77
	[0066.702] IsAppThemed () returned 0x1
	[0066.710] CoTaskMemAlloc (cb=0xf0) returned 0xa19a70
	[0066.710] CreateActCtxA (pActCtx=0x56edc8) returned 0xa19c64
	[0066.835] CoTaskMemFree (pv=0xa19a70) 
	[0066.857] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1be
	[0066.857] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc1bc
	[0067.427] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", nBufferLength=0x105, lpBuffer=0x56e73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", lpFilePart=0x0) returned 0x66
	[0067.729] GetCurrentProcess () returned 0xffffffff
	[0067.729] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x56ea74 | out: TokenHandle=0x56ea74*=0x1f0) returned 1
	[0067.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x56e52c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
	[0067.862] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x56ea6c | out: lpFileInformation=0x56ea6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1
	[0067.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x56e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0067.864] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x56ea74 | out: lpFileInformation=0x56ea74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1
	[0067.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x56e494, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0067.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x56e9ac) returned 1
	[0067.869] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40
	[0067.869] GetFileType (hFile=0x40) returned 0x1
	[0067.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x56e9a8) returned 1
	[0067.869] GetFileType (hFile=0x40) returned 0x1
	[0071.291] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x56dce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43
	[0071.291] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x56dd4c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43
	[0071.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x56df8c) returned 1
	[0071.293] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x56e250 | out: lpFileInformation=0x56e250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1
	[0071.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x56df88) returned 1
	[0071.569] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x56e11c | out: pfEnabled=0x56e11c) returned 0x0
	[0071.918] GetFileSize (in: hFile=0x40, lpFileSizeHigh=0x56ea68 | out: lpFileSizeHigh=0x56ea68*=0x0) returned 0x8c8e
	[0071.920] ReadFile (in: hFile=0x40, lpBuffer=0x2270618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x56ea24, lpOverlapped=0x0 | out: lpBuffer=0x2270618*, lpNumberOfBytesRead=0x56ea24*=0x1000, lpOverlapped=0x0) returned 1
	[0071.942] ReadFile (in: hFile=0x40, lpBuffer=0x2270618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x56e8d4, lpOverlapped=0x0 | out: lpBuffer=0x2270618*, lpNumberOfBytesRead=0x56e8d4*=0x1000, lpOverlapped=0x0) returned 1
	[0071.944] ReadFile (in: hFile=0x40, lpBuffer=0x2270618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x56e788, lpOverlapped=0x0 | out: lpBuffer=0x2270618*, lpNumberOfBytesRead=0x56e788*=0x1000, lpOverlapped=0x0) returned 1
	[0071.944] ReadFile (in: hFile=0x40, lpBuffer=0x2270618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x56e788, lpOverlapped=0x0 | out: lpBuffer=0x2270618*, lpNumberOfBytesRead=0x56e788*=0x1000, lpOverlapped=0x0) returned 1
	[0071.945] ReadFile (in: hFile=0x40, lpBuffer=0x2270618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x56e788, lpOverlapped=0x0 | out: lpBuffer=0x2270618*, lpNumberOfBytesRead=0x56e788*=0x1000, lpOverlapped=0x0) returned 1
	[0071.945] ReadFile (in: hFile=0x40, lpBuffer=0x2270618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x56e6c0, lpOverlapped=0x0 | out: lpBuffer=0x2270618*, lpNumberOfBytesRead=0x56e6c0*=0x1000, lpOverlapped=0x0) returned 1
	[0071.953] ReadFile (in: hFile=0x40, lpBuffer=0x2270618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x56e82c, lpOverlapped=0x0 | out: lpBuffer=0x2270618*, lpNumberOfBytesRead=0x56e82c*=0x1000, lpOverlapped=0x0) returned 1
	[0071.955] ReadFile (in: hFile=0x40, lpBuffer=0x2270618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x56e720, lpOverlapped=0x0 | out: lpBuffer=0x2270618*, lpNumberOfBytesRead=0x56e720*=0x1000, lpOverlapped=0x0) returned 1
	[0071.955] ReadFile (in: hFile=0x40, lpBuffer=0x2270618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x56e720, lpOverlapped=0x0 | out: lpBuffer=0x2270618*, lpNumberOfBytesRead=0x56e720*=0xc8e, lpOverlapped=0x0) returned 1
	[0071.955] ReadFile (in: hFile=0x40, lpBuffer=0x2270618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x56e7e4, lpOverlapped=0x0 | out: lpBuffer=0x2270618*, lpNumberOfBytesRead=0x56e7e4*=0x0, lpOverlapped=0x0) returned 1
	[0071.955] CloseHandle (hObject=0x40) returned 1
	[0071.955] CloseHandle (hObject=0x1f0) returned 1
	[0071.957] GetCurrentProcess () returned 0xffffffff
	[0071.957] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x56ebc0 | out: TokenHandle=0x56ebc0*=0x1f0) returned 1
	[0071.957] CloseHandle (hObject=0x1f0) returned 1
	[0071.958] GetCurrentProcess () returned 0xffffffff
	[0071.958] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x56ebc0 | out: TokenHandle=0x56ebc0*=0x1f0) returned 1
	[0071.959] CloseHandle (hObject=0x1f0) returned 1
	[0071.967] GetCurrentProcess () returned 0xffffffff
	[0071.968] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x56ea74 | out: TokenHandle=0x56ea74*=0x1f0) returned 1
	[0071.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x56ea6c | out: lpFileInformation=0x56ea6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0071.968] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", nBufferLength=0x105, lpBuffer=0x56e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", lpFilePart=0x0) returned 0x66
	[0071.969] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x56ea74 | out: lpFileInformation=0x56ea74*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0071.969] CloseHandle (hObject=0x1f0) returned 1
	[0071.969] GetCurrentProcess () returned 0xffffffff
	[0071.970] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x56ebc0 | out: TokenHandle=0x56ebc0*=0x1f0) returned 1
	[0071.970] CloseHandle (hObject=0x1f0) returned 1
	[0071.971] GetCurrentProcess () returned 0xffffffff
	[0071.971] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x56ebc0 | out: TokenHandle=0x56ebc0*=0x1f0) returned 1
	[0071.972] CloseHandle (hObject=0x1f0) returned 1
	[0071.995] GetCurrentProcess () returned 0xffffffff
	[0071.995] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x56e9d8 | out: TokenHandle=0x56e9d8*=0x1f0) returned 1
	[0072.004] CloseHandle (hObject=0x1f0) returned 1
	[0072.004] GetCurrentProcess () returned 0xffffffff
	[0072.004] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x56e9f0 | out: TokenHandle=0x56e9f0*=0x1f0) returned 1
	[0072.011] CloseHandle (hObject=0x1f0) returned 1
	[0072.017] GetSystemMetrics (nIndex=75) returned 1
	[0072.023] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0
	[0072.855] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772b0000
	[0072.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AddDllDirectory", cchWideChar=15, lpMultiByteStr=0x56ecbc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AddDllDirectory", lpUsedDefaultChar=0x0) returned 15
	[0072.859] GetProcAddress (hModule=0x772b0000, lpProcName="AddDllDirectory") returned 0x773f1e91
	[0072.860] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x800) returned 0x6e1e0000
	[0072.894] AdjustWindowRectEx (in: lpRect=0x56ee24, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x56ee24) returned 1
	[0072.905] GetCurrentProcess () returned 0xffffffff
	[0072.905] GetCurrentThread () returned 0xfffffffe
	[0072.905] GetCurrentProcess () returned 0xffffffff
	[0072.905] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x56ed3c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x56ed3c*=0x40) returned 1
	[0072.908] GetCurrentThreadId () returned 0xf48
	[0072.925] GetCurrentActCtx (in: lphActCtx=0x56ec9c | out: lphActCtx=0x56ec9c*=0x0) returned 1
	[0072.925] ActivateActCtx (in: hActCtx=0xa19c64, lpCookie=0x56ecac | out: hActCtx=0xa19c64, lpCookie=0x56ecac) returned 1
	[0072.928] GetModuleHandleW (lpModuleName="user32.dll") returned 0x766d0000
	[0072.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x56eb54, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWXo1$_\x11Dþ<r\x14ðV", lpUsedDefaultChar=0x0) returned 14
	[0072.928] GetProcAddress (hModule=0x766d0000, lpProcName="DefWindowProcW") returned 0x778f25dd
	[0072.929] GetStockObject (i=5) returned 0x1900015
	[0072.934] GetModuleHandleW (lpModuleName=0x0) returned 0x120000
	[0072.939] CoTaskMemAlloc (cb=0x5c) returned 0xa16af0
	[0072.939] RegisterClassW (lpWndClass=0x56eb44) returned 0xc1bd
	[0072.940] CoTaskMemFree (pv=0xa16af0) 
	[0072.940] GetModuleHandleW (lpModuleName=0x0) returned 0x120000
	[0072.941] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x120000, lpParam=0x0) returned 0x6014c
	[0072.943] SetWindowLongW (hWnd=0x6014c, nIndex=-4, dwNewLong=2005870045) returned 84019414
	[0072.944] GetWindowLongW (hWnd=0x6014c, nIndex=-4) returned 2005870045
	[0072.953] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x56e458 | out: phkResult=0x56e458*=0x230) returned 0x0
	[0072.955] RegQueryValueExW (in: hKey=0x230, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x56e478, lpData=0x0, lpcbData=0x56e474*=0x0 | out: lpType=0x56e478*=0x0, lpData=0x0, lpcbData=0x56e474*=0x0) returned 0x2
	[0072.956] RegQueryValueExW (in: hKey=0x230, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x56e478, lpData=0x0, lpcbData=0x56e474*=0x0 | out: lpType=0x56e478*=0x0, lpData=0x0, lpcbData=0x56e474*=0x0) returned 0x2
	[0072.956] RegCloseKey (hKey=0x230) returned 0x0
	[0072.960] SetWindowLongW (hWnd=0x6014c, nIndex=-4, dwNewLong=84019454) returned 2005870045
	[0072.960] GetWindowLongW (hWnd=0x6014c, nIndex=-4) returned 84019454
	[0072.960] GetWindowLongW (hWnd=0x6014c, nIndex=-16) returned 113311744
	[0072.962] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc059
	[0072.963] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x6014c, Msg=0x24, wParam=0x0, lParam=0x56e730) returned 0x0
	[0072.963] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc108
	[0072.964] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x6014c, Msg=0x81, wParam=0x0, lParam=0x56e724) returned 0x1
	[0072.964] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x6014c, Msg=0x83, wParam=0x0, lParam=0x56e710) returned 0x0
	[0072.965] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x6014c, Msg=0x1, wParam=0x0, lParam=0x56e724) returned 0x0
	[0072.965] GetClientRect (in: hWnd=0x6014c, lpRect=0x56e48c | out: lpRect=0x56e48c) returned 1
	[0072.965] GetWindowRect (in: hWnd=0x6014c, lpRect=0x56e48c | out: lpRect=0x56e48c) returned 1
	[0072.967] GetParent (hWnd=0x6014c) returned 0x0
	[0072.967] DeactivateActCtx (dwFlags=0x0, ulCookie=0x19ab0001) returned 1
	[0073.278] EtwEventRegister () returned 0x0
	[0073.293] GetSystemDefaultLCID () returned 0x409
	[0073.293] GetStockObject (i=17) returned 0x18a0025
	[0073.296] GetObjectW (in: h=0x18a0025, c=92, pv=0x56e41c | out: pv=0x56e41c) returned 92
	[0073.297] GetDC (hWnd=0x0) returned 0xd010939
	[0074.075] GdiplusStartup (in: token=0x206398, input=0x56d9e0, output=0x56da30 | out: token=0x206398, output=0x56da30) returned 0x0
	[0074.096] CoTaskMemAlloc (cb=0x5c) returned 0xa16af0
	[0074.097] GdipCreateFontFromLogfontW (hdc=0xd010939, logfont=0xa16af0, font=0x56e4e4) returned 0x0
	[0081.124] CoTaskMemFree (pv=0xa16af0) 
	[0081.127] CoTaskMemAlloc (cb=0x5c) returned 0xa16af0
	[0081.127] CoTaskMemFree (pv=0xa16af0) 
	[0081.128] CoTaskMemAlloc (cb=0x5c) returned 0xa16af0
	[0081.128] CoTaskMemFree (pv=0xa16af0) 
	[0081.130] GdipGetFontUnit (font=0x4562230, unit=0x56e4ac) returned 0x0
	[0081.130] GdipGetFontSize (font=0x4562230, size=0x56e4b0) returned 0x0
	[0081.130] GdipGetFontStyle (font=0x4562230, style=0x56e4a8) returned 0x0
	[0081.131] GdipGetFamily (font=0x4562230, family=0x56e4a4) returned 0x0
	[0081.132] GdipGetFontSize (font=0x4562230, size=0x229f980) returned 0x0
	[0081.133] ReleaseDC (hWnd=0x0, hDC=0xd010939) returned 1
	[0081.134] GetDC (hWnd=0x0) returned 0x20109ce
	[0081.136] GdipCreateFromHDC (hdc=0x20109ce, graphics=0x56e4c0) returned 0x0
	[0081.139] GdipGetDpiY (graphics=0x76db6d0, dpi=0x229fa5c) returned 0x0
	[0081.139] GdipGetFontHeight (font=0x4562230, graphics=0x76db6d0, height=0x56e4b8) returned 0x0
	[0081.140] GdipGetEmHeight (family=0x65ef6b0, style=0, EmHeight=0x56e4c0) returned 0x0
	[0081.140] GdipGetLineSpacing (family=0x65ef6b0, style=0, LineSpacing=0x56e4c0) returned 0x0
	[0081.141] GdipDeleteGraphics (graphics=0x76db6d0) returned 0x0
	[0081.141] ReleaseDC (hWnd=0x0, hDC=0x20109ce) returned 1
	[0081.143] GdipCreateFont (fontFamily=0x65ef6b0, emSize=0x41040000, style=0, unit=0x3, font=0x229fa78) returned 0x0
	[0081.143] GdipGetFontSize (font=0x7550e68, size=0x229fa7c) returned 0x0
	[0081.143] GdipDeleteFont (font=0x4562230) returned 0x0
	[0081.146] GetDC (hWnd=0x0) returned 0x20109ce
	[0081.146] GdipCreateFromHDC (hdc=0x20109ce, graphics=0x56e538) returned 0x0
	[0081.147] GdipGetFontHeight (font=0x7550e68, graphics=0x76db6d0, height=0x56e530) returned 0x0
	[0081.147] GdipDeleteGraphics (graphics=0x76db6d0) returned 0x0
	[0081.147] ReleaseDC (hWnd=0x0, hDC=0x20109ce) returned 1
	[0081.148] GetSystemMetrics (nIndex=5) returned 1
	[0081.148] GetSystemMetrics (nIndex=6) returned 1
	[0081.150] AdjustWindowRectEx (in: lpRect=0x56e660, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x56e660) returned 1
	[0081.171] GetProcessWindowStation () returned 0x60
	[0081.178] GetUserObjectInformationA (in: hObj=0x60, nIndex=1, pvInfo=0x22a00bc, nLength=0xc, lpnLengthNeeded=0x56dee8 | out: pvInfo=0x22a00bc, lpnLengthNeeded=0x56dee8) returned 1
	[0081.182] SetConsoleCtrlHandler (HandlerRoutine=0x502094e, Add=1) returned 1
	[0081.184] GetModuleHandleW (lpModuleName=0x0) returned 0x120000
	[0081.185] GetModuleHandleW (lpModuleName=0x0) returned 0x120000
	[0081.188] GetClassInfoW (in: hInstance=0x120000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x22a0120 | out: lpWndClass=0x22a0120) returned 0
	[0081.191] CoTaskMemAlloc (cb=0x58) returned 0xa29a70
	[0081.191] RegisterClassW (lpWndClass=0x56de38) returned 0xc1bf
	[0081.191] CoTaskMemFree (pv=0xa29a70) 
	[0081.193] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x120000, lpParam=0x0) returned 0x60020
	[0081.195] NtdllDefWindowProc_W () returned 0x1
	[0081.198] NtdllDefWindowProc_W () returned 0x0
	[0081.226] NtdllDefWindowProc_W () returned 0x0
	[0081.226] NtdllDefWindowProc_W () returned 0x0
	[0081.226] NtdllDefWindowProc_W () returned 0x0
	[0081.231] SystemParametersInfoW (in: uiAction=0x29, uiParam=0x1f4, pvParam=0x56e3d0, fWinIni=0x0 | out: pvParam=0x56e3d0) returned 1
	[0081.233] GetDC (hWnd=0x0) returned 0x20109ce
	[0081.233] CoTaskMemAlloc (cb=0x5c) returned 0xa16af0
	[0081.233] GdipCreateFontFromLogfontW (hdc=0x20109ce, logfont=0xa16af0, font=0x56e5d8) returned 0x0
	[0081.233] CoTaskMemFree (pv=0xa16af0) 
	[0081.233] CoTaskMemAlloc (cb=0x5c) returned 0xa16af0
	[0081.233] CoTaskMemFree (pv=0xa16af0) 
	[0081.234] CoTaskMemAlloc (cb=0x5c) returned 0xa16af0
	[0081.234] CoTaskMemFree (pv=0xa16af0) 
	[0081.234] GdipGetFontUnit (font=0x7550e90, unit=0x56e5a0) returned 0x0
	[0081.234] GdipGetFontSize (font=0x7550e90, size=0x56e5a4) returned 0x0
	[0081.234] GdipGetFontStyle (font=0x7550e90, style=0x56e59c) returned 0x0
	[0081.234] GdipGetFamily (font=0x7550e90, family=0x56e598) returned 0x0
	[0081.234] GdipGetFontSize (font=0x7550e90, size=0x22a0818) returned 0x0
	[0081.234] ReleaseDC (hWnd=0x0, hDC=0x20109ce) returned 1
	[0081.234] GetDC (hWnd=0x0) returned 0x20109ce
	[0081.235] GdipCreateFromHDC (hdc=0x20109ce, graphics=0x56e5ac) returned 0x0
	[0081.235] GdipGetDpiY (graphics=0x76db6d0, dpi=0x22a08f4) returned 0x0
	[0081.235] GdipGetFontHeight (font=0x7550e90, graphics=0x76db6d0, height=0x56e5a4) returned 0x0
	[0081.235] GdipGetEmHeight (family=0x6803ec8, style=0, EmHeight=0x56e5ac) returned 0x0
	[0081.235] GdipGetLineSpacing (family=0x6803ec8, style=0, LineSpacing=0x56e5ac) returned 0x0
	[0081.235] GdipDeleteGraphics (graphics=0x76db6d0) returned 0x0
	[0081.235] ReleaseDC (hWnd=0x0, hDC=0x20109ce) returned 1
	[0081.236] GdipCreateFont (fontFamily=0x6803ec8, emSize=0x41100000, style=0, unit=0x3, font=0x22a0910) returned 0x0
	[0081.236] GdipGetFontSize (font=0x7550eb8, size=0x22a0914) returned 0x0
	[0081.237] GetDC (hWnd=0x0) returned 0x20109ce
	[0081.238] GdipCreateFromHDC (hdc=0x20109ce, graphics=0x56e5f0) returned 0x0
	[0081.238] GdipGetFontHeight (font=0x7550eb8, graphics=0x76db6d0, height=0x56e5e8) returned 0x0
	[0081.238] GdipDeleteGraphics (graphics=0x76db6d0) returned 0x0
	[0081.238] ReleaseDC (hWnd=0x0, hDC=0x20109ce) returned 1
	[0081.242] GetDC (hWnd=0x0) returned 0x20109ce
	[0081.242] GdipCreateFromHDC (hdc=0x20109ce, graphics=0x56e580) returned 0x0
	[0081.242] GdipGetFontHeight (font=0x7550eb8, graphics=0x76db6d0, height=0x56e578) returned 0x0
	[0081.242] GdipDeleteGraphics (graphics=0x76db6d0) returned 0x0
	[0081.242] ReleaseDC (hWnd=0x0, hDC=0x20109ce) returned 1
	[0081.242] GetSystemMetrics (nIndex=5) returned 1
	[0081.242] GetSystemMetrics (nIndex=6) returned 1
	[0081.242] GetSystemMetrics (nIndex=5) returned 1
	[0081.242] GetSystemMetrics (nIndex=6) returned 1
	[0081.243] AdjustWindowRectEx (in: lpRect=0x56e544, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x56e544) returned 1
	[0081.248] GetSystemMetrics (nIndex=5) returned 1
	[0081.248] GetSystemMetrics (nIndex=6) returned 1
	[0081.282] AdjustWindowRectEx (in: lpRect=0x56e690, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x56e690) returned 1
	[0081.282] AdjustWindowRectEx (in: lpRect=0x56e690, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x56e690) returned 1
	[0081.283] AdjustWindowRectEx (in: lpRect=0x56e690, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x56e690) returned 1
	[0081.284] GetDC (hWnd=0x0) returned 0x20109ce
	[0081.284] GdipCreateFromHDC (hdc=0x20109ce, graphics=0x56e568) returned 0x0
	[0081.284] GdipGetFontHeight (font=0x7550e68, graphics=0x76db6d0, height=0x56e560) returned 0x0
	[0081.284] GdipDeleteGraphics (graphics=0x76db6d0) returned 0x0
	[0081.284] ReleaseDC (hWnd=0x0, hDC=0x20109ce) returned 1
	[0081.284] GetSystemMetrics (nIndex=5) returned 1
	[0081.284] GetSystemMetrics (nIndex=6) returned 1
	[0081.284] AdjustWindowRectEx (in: lpRect=0x56e690, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x56e690) returned 1
	[0081.287] AdjustWindowRectEx (in: lpRect=0x56e694, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x56e694) returned 1
	[0081.287] AdjustWindowRectEx (in: lpRect=0x56e694, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x56e694) returned 1
	[0081.288] GetDC (hWnd=0x0) returned 0x20109ce
	[0081.288] GdipCreateFromHDC (hdc=0x20109ce, graphics=0x56e568) returned 0x0
	[0081.288] GdipGetFontHeight (font=0x7550e68, graphics=0x76db6d0, height=0x56e560) returned 0x0
	[0081.288] GdipDeleteGraphics (graphics=0x76db6d0) returned 0x0
	[0081.288] ReleaseDC (hWnd=0x0, hDC=0x20109ce) returned 1
	[0081.289] GetSystemMetrics (nIndex=5) returned 1
	[0081.289] GetSystemMetrics (nIndex=6) returned 1
	[0081.289] AdjustWindowRectEx (in: lpRect=0x56e690, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x56e690) returned 1
	[0081.289] AdjustWindowRectEx (in: lpRect=0x56e690, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x56e690) returned 1
	[0081.290] AdjustWindowRectEx (in: lpRect=0x56e694, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x56e694) returned 1
	[0081.291] GetDC (hWnd=0x0) returned 0x20109ce
	[0081.291] GdipCreateFromHDC (hdc=0x20109ce, graphics=0x56e4d8) returned 0x0
	[0081.291] GdipGetFontHeight (font=0x7550e68, graphics=0x76db6d0, height=0x56e4d0) returned 0x0
	[0081.291] GdipDeleteGraphics (graphics=0x76db6d0) returned 0x0
	[0081.291] ReleaseDC (hWnd=0x0, hDC=0x20109ce) returned 1
	[0081.296] GdipGetFamilyName (in: family=0x65ef6b0, name=0x56e3dc, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0
	[0081.298] CreateCompatibleDC (hdc=0x0) returned 0x1c010b57
	[0081.299] GetCurrentObject (hdc=0x1c010b57, type=0x1) returned 0x1b00017
	[0081.299] GetCurrentObject (hdc=0x1c010b57, type=0x2) returned 0x1900010
	[0081.299] GetCurrentObject (hdc=0x1c010b57, type=0x7) returned 0x185000f
	[0081.299] GetCurrentObject (hdc=0x1c010b57, type=0x6) returned 0x18a002e
	[0081.300] SaveDC (hdc=0x1c010b57) returned 1
	[0081.301] GetDeviceCaps (hdc=0x1c010b57, index=90) returned 96
	[0081.302] CoTaskMemAlloc (cb=0x5c) returned 0xa16af0
	[0081.302] CreateFontIndirectW (lplf=0xa16af0) returned 0x200a0b4c
	[0081.302] CoTaskMemFree (pv=0xa16af0) 
	[0081.303] GetObjectW (in: h=0x200a0b4c, c=92, pv=0x56e3a0 | out: pv=0x56e3a0) returned 92
	[0081.306] GetCurrentObject (hdc=0x1c010b57, type=0x6) returned 0x18a002e
	[0081.306] GetObjectW (in: h=0x18a002e, c=92, pv=0x56e308 | out: pv=0x56e308) returned 92
	[0081.307] SelectObject (hdc=0x1c010b57, h=0x200a0b4c) returned 0x18a002e
	[0081.308] GetMapMode (hdc=0x1c010b57) returned 1
	[0081.308] GetTextMetricsW (in: hdc=0x1c010b57, lptm=0x56e3d0 | out: lptm=0x56e3d0) returned 1
	[0081.309] DrawTextExW (in: hdc=0x1c010b57, lpchText="j^", cchText=2, lprc=0x56e4dc, format=0x420, lpdtp=0x22a433c | out: lpchText="j^", lprc=0x56e4dc) returned 13
	[0081.342] GetSystemMetrics (nIndex=5) returned 1
	[0081.342] GetSystemMetrics (nIndex=6) returned 1
	[0081.343] DrawTextExW (in: hdc=0x1c010b57, lpchText="j^", cchText=2, lprc=0x56e4d4, format=0x420, lpdtp=0x22a4458 | out: lpchText="j^", lprc=0x56e4d4) returned 13
	[0081.343] GetSystemMetrics (nIndex=5) returned 1
	[0081.343] GetSystemMetrics (nIndex=6) returned 1
	[0081.343] AdjustWindowRectEx (in: lpRect=0x56e698, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x56e698) returned 1
	[0122.493] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", nBufferLength=0x105, lpBuffer=0x56d9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", lpFilePart=0x0) returned 0x66
	[0122.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x56dc30) returned 1
	[0122.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x56def4 | out: lpFileInformation=0x56def4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0122.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x56dc2c) returned 1
	[0123.180] GdipLoadImageFromStream (stream=0x3c0030, image=0x56db50) returned 0x0
	[0123.505] GdipImageForceValidation (image=0x76db6d0) returned 0x0
	[0123.515] GdipGetImageType (image=0x76db6d0, type=0x56db4c) returned 0x0
	[0123.516] GdipGetImageRawFormat (image=0x76db6d0, format=0x56dac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
	[0123.756] GdipGetImageWidth (image=0x76db6d0, width=0x56e0c8) returned 0x0
	[0123.758] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.758] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.758] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=0, color=0x56e0b4) returned 0x0
	[0123.760] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.760] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.760] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=1, color=0x56e0b4) returned 0x0
	[0123.760] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.761] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.761] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=2, color=0x56e0b4) returned 0x0
	[0123.761] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.761] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.761] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=3, color=0x56e0b4) returned 0x0
	[0123.761] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.761] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.761] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=4, color=0x56e0b4) returned 0x0
	[0123.761] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.761] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.761] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=5, color=0x56e0b4) returned 0x0
	[0123.761] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.761] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.761] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=6, color=0x56e0b4) returned 0x0
	[0123.761] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.761] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.761] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=7, color=0x56e0b4) returned 0x0
	[0123.761] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.761] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.761] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=8, color=0x56e0b4) returned 0x0
	[0123.762] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.762] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.762] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=9, color=0x56e0b4) returned 0x0
	[0123.762] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.762] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.762] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=10, color=0x56e0b4) returned 0x0
	[0123.762] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.762] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.762] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=11, color=0x56e0b4) returned 0x0
	[0123.762] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.762] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.762] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=12, color=0x56e0b4) returned 0x0
	[0123.762] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.762] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.762] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=13, color=0x56e0b4) returned 0x0
	[0123.762] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.762] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.762] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=14, color=0x56e0b4) returned 0x0
	[0123.762] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.763] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.763] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=15, color=0x56e0b4) returned 0x0
	[0123.763] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.763] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.763] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=16, color=0x56e0b4) returned 0x0
	[0123.763] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.763] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.763] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=17, color=0x56e0b4) returned 0x0
	[0123.763] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.763] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.763] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=18, color=0x56e0b4) returned 0x0
	[0123.763] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.763] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.763] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=19, color=0x56e0b4) returned 0x0
	[0123.763] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.763] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.763] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=20, color=0x56e0b4) returned 0x0
	[0123.763] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.763] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.763] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=21, color=0x56e0b4) returned 0x0
	[0123.763] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.764] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.764] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=22, color=0x56e0b4) returned 0x0
	[0123.764] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.764] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.764] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=23, color=0x56e0b4) returned 0x0
	[0123.764] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.764] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.764] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=24, color=0x56e0b4) returned 0x0
	[0123.764] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.764] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.764] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=25, color=0x56e0b4) returned 0x0
	[0123.764] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.764] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.764] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=26, color=0x56e0b4) returned 0x0
	[0123.764] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.764] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.764] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=27, color=0x56e0b4) returned 0x0
	[0123.764] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.764] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.764] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=28, color=0x56e0b4) returned 0x0
	[0123.765] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.765] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.765] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=29, color=0x56e0b4) returned 0x0
	[0123.765] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.765] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.765] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=30, color=0x56e0b4) returned 0x0
	[0123.765] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.765] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.765] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=31, color=0x56e0b4) returned 0x0
	[0123.765] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.765] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.765] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=32, color=0x56e0b4) returned 0x0
	[0123.765] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.765] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.765] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=33, color=0x56e0b4) returned 0x0
	[0123.765] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.766] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.766] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=34, color=0x56e0b4) returned 0x0
	[0123.766] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.766] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.766] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=35, color=0x56e0b4) returned 0x0
	[0123.766] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.766] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.766] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=36, color=0x56e0b4) returned 0x0
	[0123.766] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.766] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.766] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=37, color=0x56e0b4) returned 0x0
	[0123.766] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.766] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.766] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=38, color=0x56e0b4) returned 0x0
	[0123.766] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.766] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.766] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=39, color=0x56e0b4) returned 0x0
	[0123.767] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.767] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.767] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=40, color=0x56e0b4) returned 0x0
	[0123.767] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.767] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.767] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=41, color=0x56e0b4) returned 0x0
	[0123.767] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.767] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.767] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=42, color=0x56e0b4) returned 0x0
	[0123.767] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.767] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.767] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=43, color=0x56e0b4) returned 0x0
	[0123.767] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.767] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.767] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=44, color=0x56e0b4) returned 0x0
	[0123.767] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.768] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.768] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=45, color=0x56e0b4) returned 0x0
	[0123.768] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.768] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.768] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=46, color=0x56e0b4) returned 0x0
	[0123.768] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.768] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.768] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=47, color=0x56e0b4) returned 0x0
	[0123.768] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.768] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.768] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=48, color=0x56e0b4) returned 0x0
	[0123.768] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.768] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.768] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=49, color=0x56e0b4) returned 0x0
	[0123.768] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.768] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.768] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=50, color=0x56e0b4) returned 0x0
	[0123.768] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.768] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.768] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=51, color=0x56e0b4) returned 0x0
	[0123.769] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.769] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.769] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=52, color=0x56e0b4) returned 0x0
	[0123.769] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.769] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.769] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=53, color=0x56e0b4) returned 0x0
	[0123.769] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.769] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.769] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=54, color=0x56e0b4) returned 0x0
	[0123.769] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.769] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.769] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=55, color=0x56e0b4) returned 0x0
	[0123.769] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.769] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.769] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=56, color=0x56e0b4) returned 0x0
	[0123.770] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.770] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.770] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=57, color=0x56e0b4) returned 0x0
	[0123.770] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.770] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.770] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=58, color=0x56e0b4) returned 0x0
	[0123.770] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.770] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.770] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=59, color=0x56e0b4) returned 0x0
	[0123.770] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.770] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.770] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=60, color=0x56e0b4) returned 0x0
	[0123.770] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.770] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.770] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=61, color=0x56e0b4) returned 0x0
	[0123.770] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.771] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.771] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=62, color=0x56e0b4) returned 0x0
	[0123.771] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.771] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.771] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=63, color=0x56e0b4) returned 0x0
	[0123.771] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.771] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.771] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=64, color=0x56e0b4) returned 0x0
	[0123.771] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.771] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.771] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=65, color=0x56e0b4) returned 0x0
	[0123.771] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.771] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.771] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=66, color=0x56e0b4) returned 0x0
	[0123.771] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.771] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.771] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=67, color=0x56e0b4) returned 0x0
	[0123.771] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.772] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.772] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=68, color=0x56e0b4) returned 0x0
	[0123.772] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.772] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.772] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=69, color=0x56e0b4) returned 0x0
	[0123.772] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.772] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.772] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=70, color=0x56e0b4) returned 0x0
	[0123.772] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.772] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.772] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=71, color=0x56e0b4) returned 0x0
	[0123.772] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.772] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.772] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=72, color=0x56e0b4) returned 0x0
	[0123.772] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.772] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.772] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=73, color=0x56e0b4) returned 0x0
	[0123.772] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.772] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.773] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=74, color=0x56e0b4) returned 0x0
	[0123.773] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.773] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.773] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=75, color=0x56e0b4) returned 0x0
	[0123.773] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.773] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.773] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=76, color=0x56e0b4) returned 0x0
	[0123.773] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.773] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.773] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=77, color=0x56e0b4) returned 0x0
	[0123.773] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.773] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.773] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=78, color=0x56e0b4) returned 0x0
	[0123.773] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.773] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.773] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=79, color=0x56e0b4) returned 0x0
	[0123.774] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.774] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.774] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=80, color=0x56e0b4) returned 0x0
	[0123.774] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.774] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.774] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=81, color=0x56e0b4) returned 0x0
	[0123.774] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.774] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.774] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=82, color=0x56e0b4) returned 0x0
	[0123.774] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.774] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.774] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=83, color=0x56e0b4) returned 0x0
	[0123.774] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.774] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.774] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=84, color=0x56e0b4) returned 0x0
	[0123.774] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.774] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.774] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=85, color=0x56e0b4) returned 0x0
	[0123.774] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.774] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.774] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=86, color=0x56e0b4) returned 0x0
	[0123.774] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.775] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.775] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=87, color=0x56e0b4) returned 0x0
	[0123.775] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.775] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.775] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=88, color=0x56e0b4) returned 0x0
	[0123.775] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.775] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.775] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=89, color=0x56e0b4) returned 0x0
	[0123.775] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.775] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.775] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=90, color=0x56e0b4) returned 0x0
	[0123.775] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.775] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.775] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=91, color=0x56e0b4) returned 0x0
	[0123.775] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.775] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.775] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=92, color=0x56e0b4) returned 0x0
	[0123.775] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.775] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.775] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=93, color=0x56e0b4) returned 0x0
	[0123.775] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.775] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.775] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=94, color=0x56e0b4) returned 0x0
	[0123.775] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.775] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.775] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=95, color=0x56e0b4) returned 0x0
	[0123.776] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.776] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.776] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=96, color=0x56e0b4) returned 0x0
	[0123.776] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.776] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.776] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=97, color=0x56e0b4) returned 0x0
	[0123.776] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.776] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.776] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=98, color=0x56e0b4) returned 0x0
	[0123.776] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.776] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.776] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=99, color=0x56e0b4) returned 0x0
	[0123.776] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.776] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.776] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=100, color=0x56e0b4) returned 0x0
	[0123.776] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.776] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.776] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=101, color=0x56e0b4) returned 0x0
	[0123.776] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.776] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.776] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=102, color=0x56e0b4) returned 0x0
	[0123.776] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.776] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.776] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=103, color=0x56e0b4) returned 0x0
	[0123.776] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.776] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.777] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=104, color=0x56e0b4) returned 0x0
	[0123.777] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.777] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.777] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=105, color=0x56e0b4) returned 0x0
	[0123.777] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.777] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.777] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=106, color=0x56e0b4) returned 0x0
	[0123.777] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.777] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.777] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=107, color=0x56e0b4) returned 0x0
	[0123.777] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.777] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.777] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=108, color=0x56e0b4) returned 0x0
	[0123.777] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.777] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.777] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=109, color=0x56e0b4) returned 0x0
	[0123.777] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.777] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.777] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=110, color=0x56e0b4) returned 0x0
	[0123.777] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.777] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.777] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=111, color=0x56e0b4) returned 0x0
	[0123.777] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.777] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.777] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=112, color=0x56e0b4) returned 0x0
	[0123.777] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.777] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.778] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=113, color=0x56e0b4) returned 0x0
	[0123.778] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.778] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.778] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=114, color=0x56e0b4) returned 0x0
	[0123.778] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.778] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.778] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=115, color=0x56e0b4) returned 0x0
	[0123.778] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.778] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.778] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=116, color=0x56e0b4) returned 0x0
	[0123.778] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.778] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.778] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=117, color=0x56e0b4) returned 0x0
	[0123.778] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.778] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.778] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=118, color=0x56e0b4) returned 0x0
	[0123.778] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.778] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.778] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=119, color=0x56e0b4) returned 0x0
	[0123.778] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.778] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.778] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=120, color=0x56e0b4) returned 0x0
	[0123.778] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.778] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.778] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=121, color=0x56e0b4) returned 0x0
	[0123.778] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.779] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.779] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=122, color=0x56e0b4) returned 0x0
	[0123.779] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.779] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.779] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=123, color=0x56e0b4) returned 0x0
	[0123.779] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.779] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.779] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=124, color=0x56e0b4) returned 0x0
	[0123.779] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.779] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.779] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=125, color=0x56e0b4) returned 0x0
	[0123.779] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.779] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.779] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=126, color=0x56e0b4) returned 0x0
	[0123.779] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.779] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.779] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=127, color=0x56e0b4) returned 0x0
	[0123.779] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.779] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.779] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=128, color=0x56e0b4) returned 0x0
	[0123.779] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.779] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.779] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=129, color=0x56e0b4) returned 0x0
	[0123.779] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.779] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.779] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=130, color=0x56e0b4) returned 0x0
	[0123.779] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.780] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.780] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=131, color=0x56e0b4) returned 0x0
	[0123.780] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.780] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.780] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=132, color=0x56e0b4) returned 0x0
	[0123.780] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.780] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.780] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=133, color=0x56e0b4) returned 0x0
	[0123.780] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.780] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.780] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=134, color=0x56e0b4) returned 0x0
	[0123.780] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.780] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.780] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=135, color=0x56e0b4) returned 0x0
	[0123.780] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.780] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.780] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=136, color=0x56e0b4) returned 0x0
	[0123.780] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.780] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.780] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=137, color=0x56e0b4) returned 0x0
	[0123.780] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.780] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.780] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=138, color=0x56e0b4) returned 0x0
	[0123.780] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.780] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.780] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=139, color=0x56e0b4) returned 0x0
	[0123.781] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.781] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.781] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=140, color=0x56e0b4) returned 0x0
	[0123.781] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.781] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.781] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=141, color=0x56e0b4) returned 0x0
	[0123.781] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.781] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.781] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=142, color=0x56e0b4) returned 0x0
	[0123.781] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.781] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.781] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=143, color=0x56e0b4) returned 0x0
	[0123.781] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.781] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.781] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=144, color=0x56e0b4) returned 0x0
	[0123.781] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.781] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.781] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=145, color=0x56e0b4) returned 0x0
	[0123.781] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.781] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.781] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=146, color=0x56e0b4) returned 0x0
	[0123.781] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.781] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.781] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=147, color=0x56e0b4) returned 0x0
	[0123.781] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.781] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.781] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=148, color=0x56e0b4) returned 0x0
	[0123.782] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.782] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.782] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=149, color=0x56e0b4) returned 0x0
	[0123.782] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.782] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.782] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=150, color=0x56e0b4) returned 0x0
	[0123.782] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.782] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.782] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=151, color=0x56e0b4) returned 0x0
	[0123.782] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.782] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.782] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=152, color=0x56e0b4) returned 0x0
	[0123.782] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.782] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.782] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=153, color=0x56e0b4) returned 0x0
	[0123.782] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.782] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.782] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=154, color=0x56e0b4) returned 0x0
	[0123.782] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.782] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.782] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=155, color=0x56e0b4) returned 0x0
	[0123.782] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.782] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.782] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=156, color=0x56e0b4) returned 0x0
	[0123.782] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.783] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.783] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=157, color=0x56e0b4) returned 0x0
	[0123.783] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.783] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.783] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=158, color=0x56e0b4) returned 0x0
	[0123.783] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.783] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.783] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=159, color=0x56e0b4) returned 0x0
	[0123.783] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.783] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.783] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=160, color=0x56e0b4) returned 0x0
	[0123.783] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.783] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.783] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=161, color=0x56e0b4) returned 0x0
	[0123.783] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.783] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.783] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=162, color=0x56e0b4) returned 0x0
	[0123.783] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.783] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.783] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=163, color=0x56e0b4) returned 0x0
	[0123.783] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.783] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.783] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=164, color=0x56e0b4) returned 0x0
	[0123.783] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.784] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.784] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=165, color=0x56e0b4) returned 0x0
	[0123.784] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.784] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.784] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=166, color=0x56e0b4) returned 0x0
	[0123.784] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.784] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.784] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=167, color=0x56e0b4) returned 0x0
	[0123.784] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.784] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.784] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=168, color=0x56e0b4) returned 0x0
	[0123.784] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.784] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.784] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=169, color=0x56e0b4) returned 0x0
	[0123.784] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.784] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.784] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=170, color=0x56e0b4) returned 0x0
	[0123.784] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.784] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.784] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=171, color=0x56e0b4) returned 0x0
	[0123.784] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.784] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.784] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=172, color=0x56e0b4) returned 0x0
	[0123.784] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.785] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.785] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=173, color=0x56e0b4) returned 0x0
	[0123.785] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.785] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.785] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=174, color=0x56e0b4) returned 0x0
	[0123.785] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.785] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.785] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=175, color=0x56e0b4) returned 0x0
	[0123.785] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.785] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.785] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=176, color=0x56e0b4) returned 0x0
	[0123.785] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.785] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.785] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=177, color=0x56e0b4) returned 0x0
	[0123.785] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.785] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.785] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=178, color=0x56e0b4) returned 0x0
	[0123.785] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.785] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.785] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=179, color=0x56e0b4) returned 0x0
	[0123.785] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.785] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.785] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=180, color=0x56e0b4) returned 0x0
	[0123.785] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.786] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.786] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=181, color=0x56e0b4) returned 0x0
	[0123.786] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.786] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.786] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=182, color=0x56e0b4) returned 0x0
	[0123.786] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.786] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.786] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=183, color=0x56e0b4) returned 0x0
	[0123.786] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.786] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.786] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=184, color=0x56e0b4) returned 0x0
	[0123.786] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.786] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.786] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=185, color=0x56e0b4) returned 0x0
	[0123.786] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.786] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.786] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=186, color=0x56e0b4) returned 0x0
	[0123.786] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.786] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.786] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=187, color=0x56e0b4) returned 0x0
	[0123.786] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.786] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.786] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=188, color=0x56e0b4) returned 0x0
	[0123.786] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.786] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.787] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=189, color=0x56e0b4) returned 0x0
	[0123.787] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.787] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.787] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=190, color=0x56e0b4) returned 0x0
	[0123.787] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.787] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.787] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=191, color=0x56e0b4) returned 0x0
	[0123.787] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.787] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.787] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=192, color=0x56e0b4) returned 0x0
	[0123.787] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.787] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.787] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=193, color=0x56e0b4) returned 0x0
	[0123.787] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.787] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.787] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=194, color=0x56e0b4) returned 0x0
	[0123.787] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.787] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.787] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=195, color=0x56e0b4) returned 0x0
	[0123.787] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.787] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.787] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=196, color=0x56e0b4) returned 0x0
	[0123.787] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.787] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.787] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=197, color=0x56e0b4) returned 0x0
	[0123.787] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.788] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.788] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=198, color=0x56e0b4) returned 0x0
	[0123.788] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.788] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.788] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=199, color=0x56e0b4) returned 0x0
	[0123.788] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.788] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.788] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=200, color=0x56e0b4) returned 0x0
	[0123.788] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.788] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.788] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=201, color=0x56e0b4) returned 0x0
	[0123.788] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.788] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.788] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=202, color=0x56e0b4) returned 0x0
	[0123.788] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.788] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.788] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=203, color=0x56e0b4) returned 0x0
	[0123.788] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.788] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.788] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=204, color=0x56e0b4) returned 0x0
	[0123.788] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.788] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.788] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=205, color=0x56e0b4) returned 0x0
	[0123.788] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.788] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.788] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=206, color=0x56e0b4) returned 0x0
	[0123.789] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.789] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.789] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=207, color=0x56e0b4) returned 0x0
	[0123.789] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.789] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.789] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=208, color=0x56e0b4) returned 0x0
	[0123.789] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.789] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.789] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=209, color=0x56e0b4) returned 0x0
	[0123.789] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.789] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.789] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=210, color=0x56e0b4) returned 0x0
	[0123.789] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.789] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.789] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=211, color=0x56e0b4) returned 0x0
	[0123.789] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.789] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.789] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=212, color=0x56e0b4) returned 0x0
	[0123.789] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.789] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.789] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=213, color=0x56e0b4) returned 0x0
	[0123.789] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.789] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.789] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=214, color=0x56e0b4) returned 0x0
	[0123.789] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.789] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.790] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=215, color=0x56e0b4) returned 0x0
	[0123.790] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.790] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.790] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=216, color=0x56e0b4) returned 0x0
	[0123.790] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.790] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.790] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=217, color=0x56e0b4) returned 0x0
	[0123.790] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.790] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.790] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=218, color=0x56e0b4) returned 0x0
	[0123.790] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.790] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.790] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=219, color=0x56e0b4) returned 0x0
	[0123.790] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.790] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.790] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=220, color=0x56e0b4) returned 0x0
	[0123.790] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.790] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.790] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=221, color=0x56e0b4) returned 0x0
	[0123.790] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.790] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.790] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=222, color=0x56e0b4) returned 0x0
	[0123.790] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.790] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.790] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=223, color=0x56e0b4) returned 0x0
	[0123.791] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.791] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.791] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=224, color=0x56e0b4) returned 0x0
	[0123.791] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.791] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.791] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=225, color=0x56e0b4) returned 0x0
	[0123.791] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.791] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.791] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=226, color=0x56e0b4) returned 0x0
	[0123.791] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.791] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.791] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=227, color=0x56e0b4) returned 0x0
	[0123.791] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.791] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.791] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=228, color=0x56e0b4) returned 0x0
	[0123.791] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.791] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.791] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=229, color=0x56e0b4) returned 0x0
	[0123.791] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.791] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.791] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=230, color=0x56e0b4) returned 0x0
	[0123.791] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.791] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.791] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=231, color=0x56e0b4) returned 0x0
	[0123.791] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.791] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.792] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=232, color=0x56e0b4) returned 0x0
	[0123.792] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.792] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.792] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=233, color=0x56e0b4) returned 0x0
	[0123.792] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.792] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.792] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=234, color=0x56e0b4) returned 0x0
	[0123.792] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.792] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.792] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=235, color=0x56e0b4) returned 0x0
	[0123.792] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.792] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.792] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=236, color=0x56e0b4) returned 0x0
	[0123.792] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.792] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.792] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=237, color=0x56e0b4) returned 0x0
	[0123.792] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.792] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.792] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=238, color=0x56e0b4) returned 0x0
	[0123.792] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.792] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.792] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=239, color=0x56e0b4) returned 0x0
	[0123.792] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.792] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.792] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=240, color=0x56e0b4) returned 0x0
	[0123.793] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.793] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.793] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=241, color=0x56e0b4) returned 0x0
	[0123.793] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.793] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.793] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=242, color=0x56e0b4) returned 0x0
	[0123.793] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.793] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.793] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=243, color=0x56e0b4) returned 0x0
	[0123.793] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.793] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.793] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=244, color=0x56e0b4) returned 0x0
	[0123.793] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.793] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.793] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=245, color=0x56e0b4) returned 0x0
	[0123.793] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.793] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.793] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=246, color=0x56e0b4) returned 0x0
	[0123.793] GdipGetImageWidth (image=0x76db6d0, width=0x56e0a4) returned 0x0
	[0123.793] GdipGetImageHeight (image=0x76db6d0, height=0x56e0a4) returned 0x0
	[0123.793] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=247, color=0x56e0b4) returned 0x0
	[0123.793] GdipBitmapGetPixel (bitmap=0x76db6d0, x=0, y=248, color=0x56e0b4) returned 0x0
	[0124.859] CoTaskMemAlloc (cb=0xd) returned 0x5db4ab0
	[0124.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22bba2c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
	[0124.859] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000
	[0124.859] CoTaskMemFree (pv=0x5db4ab0) 
	[0124.870] CoTaskMemAlloc (cb=0x11) returned 0xa438d0
	[0124.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x22bba64, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12
	[0124.870] GetProcAddress (hModule=0x772b0000, lpProcName="ResumeThread") returned 0x772c43a7
	[0124.870] CoTaskMemFree (pv=0xa438d0) 
	[0124.885] CoTaskMemAlloc (cb=0xd) returned 0x5db4b70
	[0124.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22bbb20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
	[0124.885] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000
	[0124.885] CoTaskMemFree (pv=0x5db4b70) 
	[0124.885] CoTaskMemAlloc (cb=0x1a) returned 0xa41f90
	[0124.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x22bbb58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21
	[0124.885] GetProcAddress (hModule=0x772b0000, lpProcName="Wow64SetThreadContext") returned 0x77345933
	[0124.885] CoTaskMemFree (pv=0xa41f90) 
	[0124.897] CoTaskMemAlloc (cb=0xd) returned 0x5db4ab0
	[0124.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22bbc24, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
	[0124.898] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000
	[0124.898] CoTaskMemFree (pv=0x5db4ab0) 
	[0124.898] CoTaskMemAlloc (cb=0x15) returned 0xa438d0
	[0124.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x22bbc5c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16
	[0124.898] GetProcAddress (hModule=0x772b0000, lpProcName="SetThreadContext") returned 0x77345933
	[0124.898] CoTaskMemFree (pv=0xa438d0) 
	[0124.903] CoTaskMemAlloc (cb=0xd) returned 0x5db4ab0
	[0124.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22bbd24, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
	[0124.903] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000
	[0124.904] CoTaskMemFree (pv=0x5db4ab0) 
	[0124.904] CoTaskMemAlloc (cb=0x1a) returned 0xa41f90
	[0124.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64GetThreadContext", cchWideChar=21, lpMultiByteStr=0x22bbd5c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64GetThreadContext", lpUsedDefaultChar=0x0) returned 21
	[0124.904] GetProcAddress (hModule=0x772b0000, lpProcName="Wow64GetThreadContext") returned 0x772e799c
	[0124.904] CoTaskMemFree (pv=0xa41f90) 
	[0124.910] CoTaskMemAlloc (cb=0xd) returned 0x5db4ab0
	[0124.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22bbe28, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
	[0124.910] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000
	[0124.910] CoTaskMemFree (pv=0x5db4ab0) 
	[0124.910] CoTaskMemAlloc (cb=0x15) returned 0xa438d0
	[0124.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x22bbe60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16
	[0124.911] GetProcAddress (hModule=0x772b0000, lpProcName="GetThreadContext") returned 0x772e799c
	[0124.911] CoTaskMemFree (pv=0xa438d0) 
	[0124.916] CoTaskMemAlloc (cb=0xd) returned 0x5db4ab0
	[0124.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22bbf1c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
	[0124.916] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000
	[0124.917] CoTaskMemFree (pv=0x5db4ab0) 
	[0124.917] CoTaskMemAlloc (cb=0x13) returned 0xa435f0
	[0124.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x22bbf54, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14
	[0124.917] GetProcAddress (hModule=0x772b0000, lpProcName="VirtualAllocEx") returned 0x772dd980
	[0124.917] CoTaskMemFree (pv=0xa435f0) 
	[0124.932] CoTaskMemAlloc (cb=0xd) returned 0x5db4b70
	[0124.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22bc010, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
	[0124.932] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000
	[0124.932] CoTaskMemFree (pv=0x5db4b70) 
	[0124.932] CoTaskMemAlloc (cb=0x17) returned 0xa438d0
	[0124.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x22bc048, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18
	[0124.932] GetProcAddress (hModule=0x772b0000, lpProcName="WriteProcessMemory") returned 0x772dd9b0
	[0124.932] CoTaskMemFree (pv=0xa438d0) 
	[0124.946] CoTaskMemAlloc (cb=0xd) returned 0x5db4ab0
	[0124.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22bc10c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
	[0124.946] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000
	[0124.947] CoTaskMemFree (pv=0x5db4ab0) 
	[0124.947] CoTaskMemAlloc (cb=0x16) returned 0xa435f0
	[0124.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x22bc144, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17
	[0124.947] GetProcAddress (hModule=0x772b0000, lpProcName="ReadProcessMemory") returned 0x772dcfa4
	[0124.947] CoTaskMemFree (pv=0xa435f0) 
	[0124.954] CoTaskMemAlloc (cb=0xa) returned 0x5db4b70
	[0124.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x22bc204, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5
	[0124.954] LoadLibraryA (lpLibFileName="ntdll") returned 0x778c0000
	[0124.955] CoTaskMemFree (pv=0x5db4b70) 
	[0124.955] CoTaskMemAlloc (cb=0x19) returned 0xa41f90
	[0124.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x22bc230, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20
	[0124.955] GetProcAddress (hModule=0x778c0000, lpProcName="ZwUnmapViewOfSection") returned 0x778dfc70
	[0124.955] CoTaskMemFree (pv=0xa41f90) 
	[0124.962] CoTaskMemAlloc (cb=0xd) returned 0x5db4b70
	[0124.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22bc2f8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
	[0124.962] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000
	[0124.962] CoTaskMemFree (pv=0x5db4b70) 
	[0124.962] CoTaskMemAlloc (cb=0x13) returned 0xa435f0
	[0124.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x22bc330, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14
	[0124.962] GetProcAddress (hModule=0x772b0000, lpProcName="CreateProcessA") returned 0x772c1072
	[0124.963] CoTaskMemFree (pv=0xa435f0) 
	[0125.013] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", nBufferLength=0x105, lpBuffer=0x56d6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpFilePart=0x0) returned 0x5f
	[0125.028] GetCurrentProcess () returned 0xffffffff
	[0125.028] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x56db74 | out: TokenHandle=0x56db74*=0x174) returned 1
	[0125.042] GetTokenInformation (in: TokenHandle=0x174, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x56db6c | out: TokenInformation=0x0, ReturnLength=0x56db6c) returned 0
	[0125.043] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0xa46f18
	[0125.043] GetTokenInformation (in: TokenHandle=0x174, TokenInformationClass=0x8, TokenInformation=0xa46f18, TokenInformationLength=0x4, ReturnLength=0x56db6c | out: TokenInformation=0xa46f18, ReturnLength=0x56db6c) returned 1
	[0125.046] LocalFree (hMem=0xa46f18) returned 0x0
	[0125.048] DuplicateTokenEx (in: hExistingToken=0x174, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x56db74 | out: phNewToken=0x56db74*=0x258) returned 1
	[0125.048] CheckTokenMembership (in: TokenHandle=0x258, SidToCheck=0x22bca44*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x56db84 | out: IsMember=0x56db84) returned 1
	[0125.049] CloseHandle (hObject=0x258) returned 1
	[0125.101] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0xa438d0
	[0125.101] LocalAlloc (uFlags=0x0, uBytes=0x104) returned 0xa3f268
	[0125.109] ShellExecuteExW (in: pExecInfo=0x22bcf08*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Add-MpPreference -ExclusionPath \"C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x22bcf08*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Add-MpPreference -ExclusionPath \"C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x394)) returned 1
	[0125.121] NtdllDefWindowProc_W () returned 0x1
	[0133.437] LocalFree (hMem=0xa438d0) returned 0x0
	[0133.437] LocalFree (hMem=0xa3f268) returned 0x0
	[0134.529] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d80c | out: phkResult=0x56d80c*=0x0) returned 0x2
	[0134.543] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\Description\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x258) returned 0x0
	[0134.546] RegQueryValueExW (in: hKey=0x258, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d80c, lpData=0x0, lpcbData=0x56d808*=0x0 | out: lpType=0x56d80c*=0x7, lpData=0x0, lpcbData=0x56d808*=0x96) returned 0x0
	[0134.547] RegQueryValueExW (in: hKey=0x258, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d80c, lpData=0x22bd44c, lpcbData=0x56d808*=0x96 | out: lpType=0x56d80c*=0x7, lpData=0x22bd44c*, lpcbData=0x56d808*=0x96) returned 0x0
	[0134.660] RegQueryValueExW (in: hKey=0x258, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d860, lpData=0x0, lpcbData=0x56d85c*=0x0 | out: lpType=0x56d860*=0x7, lpData=0x0, lpcbData=0x56d85c*=0x96) returned 0x0
	[0134.667] RegQueryValueExW (in: hKey=0x258, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d848, lpData=0x0, lpcbData=0x56d844*=0x0 | out: lpType=0x56d848*=0x7, lpData=0x0, lpcbData=0x56d844*=0x96) returned 0x0
	[0134.667] RegQueryValueExW (in: hKey=0x258, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d848, lpData=0x0, lpcbData=0x56d844*=0x0 | out: lpType=0x56d848*=0x7, lpData=0x0, lpcbData=0x56d844*=0x96) returned 0x0
	[0134.667] RegQueryValueExW (in: hKey=0x258, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d848, lpData=0x0, lpcbData=0x56d844*=0x0 | out: lpType=0x56d848*=0x7, lpData=0x0, lpcbData=0x56d844*=0x96) returned 0x0
	[0134.667] RegQueryValueExW (in: hKey=0x258, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d848, lpData=0x0, lpcbData=0x56d844*=0x0 | out: lpType=0x56d848*=0x7, lpData=0x0, lpcbData=0x56d844*=0x96) returned 0x0
	[0134.667] RegQueryValueExW (in: hKey=0x258, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d848, lpData=0x0, lpcbData=0x56d844*=0x0 | out: lpType=0x56d848*=0x7, lpData=0x0, lpcbData=0x56d844*=0x96) returned 0x0
	[0134.672] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\Description\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x260) returned 0x0
	[0134.672] RegQueryValueExW (in: hKey=0x260, lpValueName="VideoBiosVersion", lpReserved=0x0, lpType=0x56d80c, lpData=0x0, lpcbData=0x56d808*=0x0 | out: lpType=0x56d80c*=0x0, lpData=0x0, lpcbData=0x56d808*=0x0) returned 0x2
	[0134.672] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Oracle\\VirtualBox Guest Additions", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x0) returned 0x2
	[0134.674] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x0) returned 0x2
	[0134.674] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\VMware, Inc.\\VMware Tools", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x0) returned 0x2
	[0134.677] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x0) returned 0x2
	[0134.677] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x0) returned 0x2
	[0134.678] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Services\\Disk\\Enum", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x25c) returned 0x0
	[0134.678] RegQueryValueExW (in: hKey=0x25c, lpValueName="0", lpReserved=0x0, lpType=0x56d80c, lpData=0x0, lpcbData=0x56d808*=0x0 | out: lpType=0x56d80c*=0x1, lpData=0x0, lpcbData=0x56d808*=0x98) returned 0x0
	[0134.678] RegQueryValueExW (in: hKey=0x25c, lpValueName="0", lpReserved=0x0, lpType=0x56d80c, lpData=0x22be798, lpcbData=0x56d808*=0x98 | out: lpType=0x56d80c*=0x1, lpData="IDE\\Disk0J38065/HTS545050A7E680_________________GW28____\\5&1981bee2&0&0.0.0", lpcbData=0x56d808*=0x98) returned 0x0
	[0134.688] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x364) returned 0x0
	[0134.689] RegQueryValueExW (in: hKey=0x364, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x56d80c, lpData=0x0, lpcbData=0x56d808*=0x0 | out: lpType=0x56d80c*=0x1, lpData=0x0, lpcbData=0x56d808*=0x3c) returned 0x0
	[0134.689] RegQueryValueExW (in: hKey=0x364, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x56d80c, lpData=0x22bed34, lpcbData=0x56d808*=0x3c | out: lpType=0x56d80c*=0x1, lpData="Standard VGA Graphics Adapter", lpcbData=0x56d808*=0x3c) returned 0x0
	[0134.690] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x360) returned 0x0
	[0134.691] RegQueryValueExW (in: hKey=0x360, lpValueName="Device Description", lpReserved=0x0, lpType=0x56d80c, lpData=0x0, lpcbData=0x56d808*=0x0 | out: lpType=0x56d80c*=0x1, lpData=0x0, lpcbData=0x56d808*=0x3c) returned 0x0
	[0134.691] RegQueryValueExW (in: hKey=0x360, lpValueName="Device Description", lpReserved=0x0, lpType=0x56d80c, lpData=0x22bf204, lpcbData=0x56d808*=0x3c | out: lpType=0x56d80c*=0x1, lpData="Standard VGA Graphics Adapter", lpcbData=0x56d808*=0x3c) returned 0x0
	[0134.691] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\VMware, Inc.\\VMware Tools", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x0) returned 0x2
	[0134.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32.dll", cchWideChar=12, lpMultiByteStr=0x56d8f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32.dllÝÑ)", lpUsedDefaultChar=0x0) returned 12
	[0134.698] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772b0000
	[0134.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wine_get_unix_file_name", cchWideChar=23, lpMultiByteStr=0x56d8dc, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wine_get_unix_file_name", lpUsedDefaultChar=0x0) returned 23
	[0134.761] GetProcAddress (hModule=0x772b0000, lpProcName="wine_get_unix_file_name") returned 0x0
	[0134.768] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x0) returned 0x2
	[0134.769] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\Description\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x56d7f4 | out: phkResult=0x56d7f4*=0x344) returned 0x0
	[0134.769] RegQueryValueExW (in: hKey=0x344, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d80c, lpData=0x0, lpcbData=0x56d808*=0x0 | out: lpType=0x56d80c*=0x7, lpData=0x0, lpcbData=0x56d808*=0x96) returned 0x0
	[0134.769] RegQueryValueExW (in: hKey=0x344, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d80c, lpData=0x22bf9ac, lpcbData=0x56d808*=0x96 | out: lpType=0x56d80c*=0x7, lpData=0x22bf9ac*, lpcbData=0x56d808*=0x96) returned 0x0
	[0134.769] RegQueryValueExW (in: hKey=0x344, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d860, lpData=0x0, lpcbData=0x56d85c*=0x0 | out: lpType=0x56d860*=0x7, lpData=0x0, lpcbData=0x56d85c*=0x96) returned 0x0
	[0134.769] RegQueryValueExW (in: hKey=0x344, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d848, lpData=0x0, lpcbData=0x56d844*=0x0 | out: lpType=0x56d848*=0x7, lpData=0x0, lpcbData=0x56d844*=0x96) returned 0x0
	[0134.769] RegQueryValueExW (in: hKey=0x344, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d848, lpData=0x0, lpcbData=0x56d844*=0x0 | out: lpType=0x56d848*=0x7, lpData=0x0, lpcbData=0x56d844*=0x96) returned 0x0
	[0134.769] RegQueryValueExW (in: hKey=0x344, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d848, lpData=0x0, lpcbData=0x56d844*=0x0 | out: lpType=0x56d848*=0x7, lpData=0x0, lpcbData=0x56d844*=0x96) returned 0x0
	[0134.769] RegQueryValueExW (in: hKey=0x344, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d848, lpData=0x0, lpcbData=0x56d844*=0x0 | out: lpType=0x56d848*=0x7, lpData=0x0, lpcbData=0x56d844*=0x96) returned 0x0
	[0134.770] RegQueryValueExW (in: hKey=0x344, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x56d848, lpData=0x0, lpcbData=0x56d844*=0x0 | out: lpType=0x56d848*=0x7, lpData=0x0, lpcbData=0x56d844*=0x96) returned 0x0
	[0135.038] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x340
	[0135.083] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x338
	[0135.180] SetEvent (hEvent=0x338) returned 1
	[0135.182] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x56d8a8*=0x340, lpdwindex=0x56d6cc | out: lpdwindex=0x56d6cc) returned 0x0
	[0137.726] CoGetContextToken (in: pToken=0x56d77c | out: pToken=0x56d77c) returned 0x0
	[0137.727] CoGetContextToken (in: pToken=0x56d6dc | out: pToken=0x56d6dc) returned 0x0
	[0137.727] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b688, riid=0x56d7ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x56d7a8 | out: ppvObject=0x56d7a8*=0xa1b688) returned 0x0
	[0137.728] WbemDefPath:IUnknown:AddRef (This=0xa1b688) returned 0x3
	[0137.728] WbemDefPath:IUnknown:Release (This=0xa1b688) returned 0x2
	[0137.842] WbemDefPath:IWbemPath:SetText (This=0xa1b688, uMode=0x4, pszPath="\\\\.\\ROOT\\cimv2") returned 0x0
	[0137.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x56d924 | out: puCount=0x56d924*=0x2) returned 0x0
	[0137.850] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d920*=0x0, pszText=0x0 | out: puBuffLength=0x56d920*=0xf, pszText=0x0) returned 0x0
	[0137.850] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d920*=0xf, pszText="00000000000000" | out: puBuffLength=0x56d920*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0137.852] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x56d91c | out: puCount=0x56d91c*=0x2) returned 0x0
	[0137.852] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d918*=0x0, pszText=0x0 | out: puBuffLength=0x56d918*=0xf, pszText=0x0) returned 0x0
	[0137.852] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d918*=0xf, pszText="00000000000000" | out: puBuffLength=0x56d918*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0138.218] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x56d7a4*=0x3e0, lpdwindex=0x56d65c | out: lpdwindex=0x56d65c) returned 0x0
	[0144.577] CoGetContextToken (in: pToken=0x56d5d4 | out: pToken=0x56d5d4) returned 0x0
	[0144.577] CoGetContextToken (in: pToken=0x56d534 | out: pToken=0x56d534) returned 0x0
	[0144.629] CoGetContextToken (in: pToken=0x56d534 | out: pToken=0x56d534) returned 0x0
	[0144.629] CoGetContextToken (in: pToken=0x56d4d4 | out: pToken=0x56d4d4) returned 0x0
	[0144.629] IUnknown:QueryInterface (in: This=0x9ffb70, riid=0x72588ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56d4ac | out: ppvObject=0x56d4ac*=0x9ffb80) returned 0x0
	[0144.630] CObjectContext::ContextCallback () returned 0x0
	[0144.650] IUnknown:Release (This=0x9ffb80) returned 0x1
	[0144.652] CoUnmarshalInterface (in: pStm=0xa7bc68, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x56d528 | out: ppv=0x56d528*=0xa64414) returned 0x0
	[0144.652] CoMarshalInterface (pStm=0xa7bc68, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa64414, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
	[0144.652] WbemLocator:IUnknown:QueryInterface (in: This=0xa64414, riid=0x56d604*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x56d600 | out: ppvObject=0x56d600*=0xa705c0) returned 0x0
	[0144.722] WbemLocator:IUnknown:Release (This=0xa64414) returned 0x1
	[0144.722] IWbemServices:ExecQuery (in: This=0xa705c0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_VideoController", lFlags=16, pCtx=0x0, ppEnum=0x56d868 | out: ppEnum=0x56d868*=0x9fd0a0) returned 0x0
	[0144.812] IUnknown:QueryInterface (in: This=0x9fd0a0, riid=0x703935b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56d638 | out: ppvObject=0x56d638*=0x9fd0a4) returned 0x0
	[0144.812] IClientSecurity:QueryBlanket (in: This=0x9fd0a4, pProxy=0x9fd0a0, pAuthnSvc=0x56d688, pAuthzSvc=0x56d684, pServerPrincName=0x56d67c, pAuthnLevel=0x56d680, pImpLevel=0x56d670, pAuthInfo=0x56d674, pCapabilites=0x56d678 | out: pAuthnSvc=0x56d688*=0xa, pAuthzSvc=0x56d684*=0x0, pServerPrincName=0x56d67c, pAuthnLevel=0x56d680*=0x6, pImpLevel=0x56d670*=0x2, pAuthInfo=0x56d674, pCapabilites=0x56d678*=0x1) returned 0x0
	[0144.812] IUnknown:Release (This=0x9fd0a4) returned 0x1
	[0144.813] IUnknown:QueryInterface (in: This=0x9fd0a0, riid=0x703935a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56d62c | out: ppvObject=0x56d62c*=0xa64504) returned 0x0
	[0144.813] IUnknown:QueryInterface (in: This=0x9fd0a0, riid=0x703935b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56d618 | out: ppvObject=0x56d618*=0x9fd0a4) returned 0x0
	[0144.813] IClientSecurity:SetBlanket (This=0x9fd0a4, pProxy=0x9fd0a0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0144.845] IUnknown:Release (This=0x9fd0a4) returned 0x2
	[0144.845] WbemLocator:IUnknown:Release (This=0xa64504) returned 0x1
	[0144.845] CoTaskMemFree (pv=0xaa2640) 
	[0144.845] IUnknown:AddRef (This=0x9fd0a0) returned 0x2
	[0144.847] CoGetContextToken (in: pToken=0x56cb58 | out: pToken=0x56cb58) returned 0x0
	[0144.847] IUnknown:QueryInterface (in: This=0x9ffa00, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56cb10 | out: ppvObject=0x56cb10*=0x9ffa0c) returned 0x0
	[0144.847] IComThreadingInfo:GetCurrentApartmentType (in: This=0x9ffa0c, pAptType=0x56cb4c | out: pAptType=0x56cb4c*=3) returned 0x0
	[0144.847] IUnknown:Release (This=0x9ffa0c) returned 0x0
	[0144.847] CoGetObjectContext (in: riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xaa348c | out: ppv=0xaa348c*=0x9ffa00) returned 0x0
	[0144.847] CoGetContextToken (in: pToken=0x56cf6c | out: pToken=0x56cf6c) returned 0x0
	[0144.847] IUnknown:QueryInterface (in: This=0x9fd0a0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56cf04 | out: ppvObject=0x56cf04*=0xa644ec) returned 0x0
	[0144.848] WbemLocator:IRpcOptions:Query (in: This=0xa644ec, pPrx=0xaa3428, dwProperty=2, pdwValue=0x56cff8 | out: pdwValue=0x56cff8) returned 0x80004002
	[0144.848] WbemLocator:IUnknown:Release (This=0xa644ec) returned 0x2
	[0144.848] CoGetContextToken (in: pToken=0x56d53c | out: pToken=0x56d53c) returned 0x0
	[0144.848] CoGetContextToken (in: pToken=0x56d49c | out: pToken=0x56d49c) returned 0x0
	[0144.848] IUnknown:QueryInterface (in: This=0x9fd0a0, riid=0x56d56c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x56d438 | out: ppvObject=0x56d438*=0x9fd0a0) returned 0x0
	[0144.848] IUnknown:Release (This=0x9fd0a0) returned 0x2
	[0144.849] WbemLocator:IUnknown:Release (This=0xa705c0) returned 0x0
	[0144.849] SysStringLen (param_1=0x0) returned 0x0
	[0144.850] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x56d8b8 | out: puCount=0x56d8b8*=0x2) returned 0x0
	[0144.850] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0x0, pszText=0x0 | out: puBuffLength=0x56d8b4*=0xf, pszText=0x0) returned 0x0
	[0144.850] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0xf, pszText="00000000000000" | out: puBuffLength=0x56d8b4*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0144.859] CoGetContextToken (in: pToken=0x56d6bc | out: pToken=0x56d6bc) returned 0x0
	[0144.859] IEnumWbemClassObject:Clone (in: This=0x9fd0a0, ppEnum=0x56d8c4 | out: ppEnum=0x56d8c4*=0x9fcf10) returned 0x0
	[0144.861] IUnknown:QueryInterface (in: This=0x9fcf10, riid=0x703935b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56d72c | out: ppvObject=0x56d72c*=0x9fcf14) returned 0x0
	[0144.861] IClientSecurity:QueryBlanket (in: This=0x9fcf14, pProxy=0x9fcf10, pAuthnSvc=0x56d77c, pAuthzSvc=0x56d778, pServerPrincName=0x56d770, pAuthnLevel=0x56d774, pImpLevel=0x56d764, pAuthInfo=0x56d768, pCapabilites=0x56d76c | out: pAuthnSvc=0x56d77c*=0xa, pAuthzSvc=0x56d778*=0x0, pServerPrincName=0x56d770, pAuthnLevel=0x56d774*=0x6, pImpLevel=0x56d764*=0x2, pAuthInfo=0x56d768, pCapabilites=0x56d76c*=0x1) returned 0x0
	[0144.861] IUnknown:Release (This=0x9fcf14) returned 0x1
	[0144.861] IUnknown:QueryInterface (in: This=0x9fcf10, riid=0x703935a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56d720 | out: ppvObject=0x56d720*=0xa64414) returned 0x0
	[0144.861] IUnknown:QueryInterface (in: This=0x9fcf10, riid=0x703935b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56d70c | out: ppvObject=0x56d70c*=0x9fcf14) returned 0x0
	[0144.861] IClientSecurity:SetBlanket (This=0x9fcf14, pProxy=0x9fcf10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0144.865] IUnknown:Release (This=0x9fcf14) returned 0x2
	[0144.865] WbemLocator:IUnknown:Release (This=0xa64414) returned 0x1
	[0144.866] CoTaskMemFree (pv=0xaa2610) 
	[0144.866] IUnknown:AddRef (This=0x9fcf10) returned 0x2
	[0144.866] CoGetContextToken (in: pToken=0x56cc3c | out: pToken=0x56cc3c) returned 0x0
	[0144.866] CoGetContextToken (in: pToken=0x56d04c | out: pToken=0x56d04c) returned 0x0
	[0144.866] IUnknown:QueryInterface (in: This=0x9fcf10, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56cfe8 | out: ppvObject=0x56cfe8*=0xa643fc) returned 0x0
	[0144.867] WbemLocator:IRpcOptions:Query (in: This=0xa643fc, pPrx=0xaa3458, dwProperty=2, pdwValue=0x56d0dc | out: pdwValue=0x56d0dc) returned 0x80004002
	[0144.867] WbemLocator:IUnknown:Release (This=0xa643fc) returned 0x2
	[0144.867] CoGetContextToken (in: pToken=0x56d61c | out: pToken=0x56d61c) returned 0x0
	[0144.867] CoGetContextToken (in: pToken=0x56d57c | out: pToken=0x56d57c) returned 0x0
	[0144.867] IUnknown:QueryInterface (in: This=0x9fcf10, riid=0x56d64c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x56d518 | out: ppvObject=0x56d518*=0x9fcf10) returned 0x0
	[0144.867] IUnknown:Release (This=0x9fcf10) returned 0x2
	[0144.867] SysStringLen (param_1=0x0) returned 0x0
	[0144.868] IEnumWbemClassObject:Reset (This=0x9fcf10) returned 0x0
	[0144.884] CoTaskMemAlloc (cb=0x4) returned 0xaa79a0
	[0144.885] IEnumWbemClassObject:Next (in: This=0x9fcf10, lTimeout=-1, uCount=0x1, apObjects=0xaa79a0, puReturned=0x22c3d0c | out: apObjects=0xaa79a0*=0xaaaf98, puReturned=0x22c3d0c*=0x1) returned 0x0
	[0144.898] IUnknown:QueryInterface (in: This=0xaaaf98, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56cf1c | out: ppvObject=0x56cf1c*=0xaaaf98) returned 0x0
	[0144.898] IUnknown:QueryInterface (in: This=0xaaaf98, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x56ced0 | out: ppvObject=0x56ced0*=0x0) returned 0x80004002
	[0144.898] IUnknown:QueryInterface (in: This=0xaaaf98, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x56ccf8 | out: ppvObject=0x56ccf8*=0x0) returned 0x80004002
	[0144.899] IUnknown:AddRef (This=0xaaaf98) returned 0x3
	[0144.899] IUnknown:QueryInterface (in: This=0xaaaf98, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x56c82c | out: ppvObject=0x56c82c*=0x0) returned 0x80004002
	[0144.899] IUnknown:QueryInterface (in: This=0xaaaf98, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x56c7dc | out: ppvObject=0x56c7dc*=0x0) returned 0x80004002
	[0144.899] IUnknown:QueryInterface (in: This=0xaaaf98, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56c7e8 | out: ppvObject=0x56c7e8*=0xaaaf9c) returned 0x0
	[0144.900] IMarshal:GetUnmarshalClass (in: This=0xaaaf9c, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x56c7f0 | out: pCid=0x56c7f0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0144.901] IUnknown:Release (This=0xaaaf9c) returned 0x3
	[0144.901] CoGetContextToken (in: pToken=0x56c848 | out: pToken=0x56c848) returned 0x0
	[0144.901] CoGetContextToken (in: pToken=0x56cc5c | out: pToken=0x56cc5c) returned 0x0
	[0144.901] IUnknown:QueryInterface (in: This=0xaaaf98, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56ccdc | out: ppvObject=0x56ccdc*=0x0) returned 0x80004002
	[0144.901] IUnknown:Release (This=0xaaaf98) returned 0x2
	[0144.901] CoGetContextToken (in: pToken=0x56d244 | out: pToken=0x56d244) returned 0x0
	[0144.901] CoGetContextToken (in: pToken=0x56d1a4 | out: pToken=0x56d1a4) returned 0x0
	[0144.901] IUnknown:QueryInterface (in: This=0xaaaf98, riid=0x56d274*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x56d270 | out: ppvObject=0x56d270*=0xaaaf98) returned 0x0
	[0144.901] IUnknown:AddRef (This=0xaaaf98) returned 0x4
	[0144.901] IUnknown:Release (This=0xaaaf98) returned 0x3
	[0144.902] IUnknown:Release (This=0xaaaf98) returned 0x2
	[0144.902] CoTaskMemFree (pv=0xaa79a0) 
	[0144.902] CoGetContextToken (in: pToken=0x56d5b4 | out: pToken=0x56d5b4) returned 0x0
	[0144.902] IUnknown:AddRef (This=0xaaaf98) returned 0x3
	[0144.912] IWbemClassObject:Get (in: This=0xaaaf98, wszName="__GENUS", lFlags=0, pVal=0x56d8a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x56d934*=0, plFlavor=0x56d930*=0 | out: pVal=0x56d8a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x56d934*=3, plFlavor=0x56d930*=64) returned 0x0
	[0144.915] IWbemClassObject:Get (in: This=0xaaaf98, wszName="__PATH", lFlags=0, pVal=0x56d884*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x56d91c*=0, plFlavor=0x56d918*=0 | out: pVal=0x56d884*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"", varVal2=0x0), pType=0x56d91c*=8, plFlavor=0x56d918*=64) returned 0x0
	[0144.919] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x92
	[0144.919] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x92
	[0144.920] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x444
	[0144.921] SetEvent (hEvent=0x338) returned 1
	[0144.927] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x56d870*=0x444, lpdwindex=0x56d694 | out: lpdwindex=0x56d694) returned 0x0
	[0144.928] CoGetContextToken (in: pToken=0x56d744 | out: pToken=0x56d744) returned 0x0
	[0144.928] CoGetContextToken (in: pToken=0x56d6a4 | out: pToken=0x56d6a4) returned 0x0
	[0144.928] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b7d8, riid=0x56d774*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x56d770 | out: ppvObject=0x56d770*=0xa1b7d8) returned 0x0
	[0144.928] WbemDefPath:IUnknown:AddRef (This=0xa1b7d8) returned 0x3
	[0144.928] WbemDefPath:IUnknown:Release (This=0xa1b7d8) returned 0x2
	[0144.928] WbemDefPath:IWbemPath:SetText (This=0xa1b7d8, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x0
	[0144.928] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x56d8f0 | out: puCount=0x56d8f0*=0x2) returned 0x0
	[0144.928] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8ec*=0x0, pszText=0x0 | out: puBuffLength=0x56d8ec*=0xf, pszText=0x0) returned 0x0
	[0144.928] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x56d8ec*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0144.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x56d8b8 | out: puCount=0x56d8b8*=0x2) returned 0x0
	[0144.934] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0x0, pszText=0x0 | out: puBuffLength=0x56d8b4*=0xf, pszText=0x0) returned 0x0
	[0144.934] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0xf, pszText="00000000000000" | out: puBuffLength=0x56d8b4*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0144.934] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c4640*=0, plFlavor=0x22c4644*=0 | out: pVal=0x56d8a0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c4640*=8, plFlavor=0x22c4644*=0) returned 0x0
	[0144.934] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.934] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.935] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c4640*=8, plFlavor=0x22c4644*=0 | out: pVal=0x56d8a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c4640*=8, plFlavor=0x22c4644*=0) returned 0x0
	[0144.935] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.935] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.936] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x56d8b8 | out: puCount=0x56d8b8*=0x2) returned 0x0
	[0144.936] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0x0, pszText=0x0 | out: puBuffLength=0x56d8b4*=0xf, pszText=0x0) returned 0x0
	[0144.936] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0xf, pszText="00000000000000" | out: puBuffLength=0x56d8b4*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0144.936] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c4760*=0, plFlavor=0x22c4764*=0 | out: pVal=0x56d8a0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c4760*=8, plFlavor=0x22c4764*=0) returned 0x0
	[0144.936] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.936] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.936] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c4760*=8, plFlavor=0x22c4764*=0 | out: pVal=0x56d8a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c4760*=8, plFlavor=0x22c4764*=0) returned 0x0
	[0144.937] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.937] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.937] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x56d8b8 | out: puCount=0x56d8b8*=0x2) returned 0x0
	[0144.937] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0x0, pszText=0x0 | out: puBuffLength=0x56d8b4*=0xf, pszText=0x0) returned 0x0
	[0144.937] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0xf, pszText="00000000000000" | out: puBuffLength=0x56d8b4*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0144.937] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c4868*=0, plFlavor=0x22c486c*=0 | out: pVal=0x56d8a0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c4868*=8, plFlavor=0x22c486c*=0) returned 0x0
	[0144.937] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.937] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.937] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c4868*=8, plFlavor=0x22c486c*=0 | out: pVal=0x56d8a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c4868*=8, plFlavor=0x22c486c*=0) returned 0x0
	[0144.938] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.938] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.938] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x56d8b8 | out: puCount=0x56d8b8*=0x2) returned 0x0
	[0144.938] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0x0, pszText=0x0 | out: puBuffLength=0x56d8b4*=0xf, pszText=0x0) returned 0x0
	[0144.938] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0xf, pszText="00000000000000" | out: puBuffLength=0x56d8b4*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0144.938] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c498c*=0, plFlavor=0x22c4990*=0 | out: pVal=0x56d8a0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c498c*=8, plFlavor=0x22c4990*=0) returned 0x0
	[0144.938] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.938] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.939] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c498c*=8, plFlavor=0x22c4990*=0 | out: pVal=0x56d8a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c498c*=8, plFlavor=0x22c4990*=0) returned 0x0
	[0144.939] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.939] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.939] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x56d8b8 | out: puCount=0x56d8b8*=0x2) returned 0x0
	[0144.939] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0x0, pszText=0x0 | out: puBuffLength=0x56d8b4*=0xf, pszText=0x0) returned 0x0
	[0144.939] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8b4*=0xf, pszText="00000000000000" | out: puBuffLength=0x56d8b4*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0144.940] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c4a98*=0, plFlavor=0x22c4a9c*=0 | out: pVal=0x56d8a0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c4a98*=8, plFlavor=0x22c4a9c*=0) returned 0x0
	[0144.940] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.940] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.940] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c4a98*=8, plFlavor=0x22c4a9c*=0 | out: pVal=0x56d8a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c4a98*=8, plFlavor=0x22c4a9c*=0) returned 0x0
	[0144.940] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.940] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.941] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x56d8d0 | out: puCount=0x56d8d0*=0x2) returned 0x0
	[0144.941] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8cc*=0x0, pszText=0x0 | out: puBuffLength=0x56d8cc*=0xf, pszText=0x0) returned 0x0
	[0144.941] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=4, puBuffLength=0x56d8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x56d8cc*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0144.941] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8b8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c4bc8*=0, plFlavor=0x22c4bcc*=0 | out: pVal=0x56d8b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c4bc8*=8, plFlavor=0x22c4bcc*=0) returned 0x0
	[0144.941] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.942] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.943] IWbemClassObject:Get (in: This=0xaaaf98, wszName="Description", lFlags=0, pVal=0x56d8c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c4bc8*=8, plFlavor=0x22c4bcc*=0 | out: pVal=0x56d8c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NVIDIA Quadro K510M", varVal2=0x0), pType=0x22c4bc8*=8, plFlavor=0x22c4bcc*=0) returned 0x0
	[0144.943] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.943] SysStringByteLen (bstr="NVIDIA Quadro K510M") returned 0x26
	[0144.944] CoTaskMemAlloc (cb=0x4) returned 0xaa79e0
	[0144.944] IEnumWbemClassObject:Next (in: This=0x9fcf10, lTimeout=-1, uCount=0x1, apObjects=0xaa79e0, puReturned=0x22c3d0c | out: apObjects=0xaa79e0*=0x0, puReturned=0x22c3d0c*=0x0) returned 0x1
	[0144.947] CoTaskMemFree (pv=0xaa79e0) 
	[0144.955] CoGetContextToken (in: pToken=0x56d7ec | out: pToken=0x56d7ec) returned 0x0
	[0144.955] IUnknown:Release (This=0x9fd0a0) returned 0x1
	[0144.955] IUnknown:Release (This=0x9fd0a0) returned 0x0
	[0145.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", cchWideChar=95, lpMultiByteStr=0x56d880, cbMultiByte=97, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpUsedDefaultChar=0x0) returned 95
	[0145.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x56d87c, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0cî\x1f\x02C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpUsedDefaultChar=0x0) returned 0
	[0145.214] CreateProcessA (in: lpApplicationName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x56d940*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x56dc08 | out: lpCommandLine="", lpProcessInformation=0x56dc08*(hProcess=0x450, hThread=0x44c, dwProcessId=0xac4, dwThreadId=0xac0)) returned 1
	[0145.233] CoTaskMemFree (pv=0x0) 
	[0145.275] GetThreadContext (in: hThread=0x44c, lpContext=0x22c4ca8 | out: lpContext=0x22c4ca8*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x1dfcf2, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
	[0145.276] ReadProcessMemory (in: hProcess=0x450, lpBaseAddress=0x7efde008, lpBuffer=0x56dbf8, nSize=0x4, lpNumberOfBytesRead=0x56dc3c | out: lpBuffer=0x56dbf8*, lpNumberOfBytesRead=0x56dc3c*=0x4) returned 1
	[0145.283] VirtualAllocEx (hProcess=0x450, lpAddress=0x400000, dwSize=0x3c000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0145.298] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x56d244 | out: lpLuid=0x56d244*(LowPart=0x14, HighPart=0)) returned 1
	[0145.300] GetCurrentProcess () returned 0xffffffff
	[0145.301] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x56d240 | out: TokenHandle=0x56d240*=0x458) returned 1
	[0145.301] AdjustTokenPrivileges (in: TokenHandle=0x458, DisableAllPrivileges=0, NewState=0x22c5040*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0145.301] CloseHandle (hObject=0x458) returned 1
	[0145.318] EnumProcesses (in: lpidProcess=0x22c5830, cb=0x400, lpcbNeeded=0x56d92c | out: lpidProcess=0x22c5830, lpcbNeeded=0x56d92c) returned 1
	[0145.336] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xac4) returned 0x458
	[0145.350] TerminateProcess (hProcess=0x458, uExitCode=0xffffffff) returned 1
	[0145.359] CloseHandle (hObject=0x458) returned 1
	[0145.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", cchWideChar=95, lpMultiByteStr=0x56d880, cbMultiByte=97, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpUsedDefaultChar=0x0) returned 95
	[0145.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x56d87c, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0cî\x1f\x02C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpUsedDefaultChar=0x0) returned 0
	[0145.359] CreateProcessA (in: lpApplicationName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x56d940*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x56dc08 | out: lpCommandLine="", lpProcessInformation=0x56dc08*(hProcess=0x454, hThread=0x458, dwProcessId=0xabc, dwThreadId=0xab8)) returned 1
	[0145.363] CoTaskMemFree (pv=0x0) 
	[0145.364] GetThreadContext (in: hThread=0x458, lpContext=0x22c5ed8 | out: lpContext=0x22c5ed8*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x1dfcf2, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
	[0145.377] ReadProcessMemory (in: hProcess=0x454, lpBaseAddress=0x7efde008, lpBuffer=0x56dbf8, nSize=0x4, lpNumberOfBytesRead=0x56dc3c | out: lpBuffer=0x56dbf8*, lpNumberOfBytesRead=0x56dc3c*=0x4) returned 1
	[0145.377] VirtualAllocEx (hProcess=0x454, lpAddress=0x400000, dwSize=0x3c000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000
	[0145.379] WriteProcessMemory (in: hProcess=0x454, lpBaseAddress=0x400000, lpBuffer=0x33182c0*, nSize=0x200, lpNumberOfBytesWritten=0x56dc3c | out: lpBuffer=0x33182c0*, lpNumberOfBytesWritten=0x56dc3c*=0x200) returned 1
	[0145.411] WriteProcessMemory (in: hProcess=0x454, lpBaseAddress=0x402000, lpBuffer=0x34af8c0*, nSize=0x35600, lpNumberOfBytesWritten=0x56dc3c | out: lpBuffer=0x34af8c0*, lpNumberOfBytesWritten=0x56dc3c*=0x35600) returned 1
	[0145.487] WriteProcessMemory (in: hProcess=0x454, lpBaseAddress=0x438000, lpBuffer=0x22c61b0*, nSize=0x400, lpNumberOfBytesWritten=0x56dc3c | out: lpBuffer=0x22c61b0*, lpNumberOfBytesWritten=0x56dc3c*=0x400) returned 1
	[0145.494] WriteProcessMemory (in: hProcess=0x454, lpBaseAddress=0x43a000, lpBuffer=0x22c65bc*, nSize=0x200, lpNumberOfBytesWritten=0x56dc3c | out: lpBuffer=0x22c65bc*, lpNumberOfBytesWritten=0x56dc3c*=0x200) returned 1
	[0145.508] WriteProcessMemory (in: hProcess=0x454, lpBaseAddress=0x7efde008, lpBuffer=0x22c67c8*, nSize=0x4, lpNumberOfBytesWritten=0x56dc3c | out: lpBuffer=0x22c67c8*, lpNumberOfBytesWritten=0x56dc3c*=0x4) returned 1
	[0145.514] SetThreadContext (hThread=0x458, lpContext=0x22c5ed8*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x4375ee, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
	[0145.519] ResumeThread (hThread=0x458) returned 0x1
	[0145.643] CoGetContextToken (in: pToken=0x56e008 | out: pToken=0x56e008) returned 0x0
	[0145.643] IUnknown:QueryInterface (in: This=0x9ffa00, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56e02c | out: ppvObject=0x56e02c*=0x9ffa0c) returned 0x0
	[0145.644] IComThreadingInfo:GetCurrentThreadType (in: This=0x9ffa0c, pThreadType=0x56e08c | out: pThreadType=0x56e08c*=1) returned 0x0
	[0145.644] IUnknown:Release (This=0x9ffa0c) returned 0x1
	[0145.645] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x9c4180*=0xac, lpdwindex=0x56deb4 | out: lpdwindex=0x56deb4) returned 0x0
	[0145.728] CoGetContextToken (in: pToken=0x56d428 | out: pToken=0x56d428) returned 0x0
	[0145.728] CoGetContextToken (in: pToken=0x56d3e4 | out: pToken=0x56d3e4) returned 0x0
	[0145.728] IUnknown:Release (This=0x9fcf10) returned 0x1
	[0145.728] IUnknown:Release (This=0x9fcf10) returned 0x0
	[0146.053] CoGetContextToken (in: pToken=0x56d428 | out: pToken=0x56d428) returned 0x0
	[0146.053] CoGetContextToken (in: pToken=0x56d40c | out: pToken=0x56d40c) returned 0x0
	[0146.053] CoGetContextToken (in: pToken=0x56d390 | out: pToken=0x56d390) returned 0x0
	[0146.053] IUnknown:Release (This=0xaaaf98) returned 0x1
	[0146.053] IUnknown:Release (This=0xaaaf98) returned 0x0

Thread:
	id = 2
	os_tid = 0xf54


Thread:
	id = 3
	os_tid = 0xf58

	[0064.775] CoGetContextToken (in: pToken=0x442f5ac | out: pToken=0x442f5ac) returned 0x800401f0
	[0064.775] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0081.654] GdipDeleteFont (font=0x7550e90) returned 0x0
	[0145.694] SetWindowLongW (hWnd=0x6014c, nIndex=-4, dwNewLong=2005870045) returned 84019454
	[0145.696] SetClassLongW (hWnd=0x6014c, nIndex=-24, dwNewLong=2005870045) returned 0x50208d6
	[0145.697] PostMessageW (hWnd=0x6014c, Msg=0x10, wParam=0x0, lParam=0x0) returned 1
	[0145.699] GetModuleHandleW (lpModuleName=0x0) returned 0x120000
	[0145.699] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", hInstance=0x120000) returned 0
	[0145.700] EtwEventUnregister () returned 0x0
	[0145.709] IsWindow (hWnd=0x60020) returned 1
	[0145.713] GetModuleHandleW (lpModuleName="user32.dll") returned 0x766d0000
	[0145.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x442f32c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWdp1$_\x11Dþ<r¬õB\x04\x01", lpUsedDefaultChar=0x0) returned 14
	[0145.714] GetProcAddress (hModule=0x766d0000, lpProcName="DefWindowProcW") returned 0x778f25dd
	[0145.715] SetWindowLongW (hWnd=0x60020, nIndex=-4, dwNewLong=2005870045) returned 84019574
	[0145.716] SetClassLongW (hWnd=0x60020, nIndex=-24, dwNewLong=2005870045) returned 0x5020976
	[0145.716] IsWindow (hWnd=0x60020) returned 1
	[0145.716] DestroyWindow (hWnd=0x60020) returned 0
	[0145.717] PostMessageW (hWnd=0x60020, Msg=0x10, wParam=0x0, lParam=0x0) returned 1
	[0145.717] SetConsoleCtrlHandler (HandlerRoutine=0x502094e, Add=0) returned 1
	[0145.726] IUnknown:Release (This=0xaaaf98) returned 0x2
	[0145.727] CoGetContextToken (in: pToken=0x442f3f0 | out: pToken=0x442f3f0) returned 0x0
	[0145.727] IUnknown:QueryInterface (in: This=0x9ffa00, riid=0x72588ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x442f390 | out: ppvObject=0x442f390*=0x9ffa10) returned 0x0
	[0145.727] CObjectContext::ContextCallback () returned 0x0
	[0145.863] IUnknown:Release (This=0x9ffa10) returned 0x1
	[0145.865] GdipDisposeImage (image=0x76db6d0) returned 0x0
	[0145.884] GetCurrentObject (hdc=0x1c010b57, type=0x6) returned 0x200a0b4c
	[0145.884] SelectObject (hdc=0x1c010b57, h=0x18a002e) returned 0x200a0b4c
	[0145.887] DeleteObject (ho=0x200a0b4c) returned 1
	[0145.888] DeleteDC (hdc=0x1c010b57) returned 1
	[0145.888] GdipDeleteFont (font=0x7550eb8) returned 0x0
	[0145.889] RestoreDC (hdc=0x0, nSavedDC=-1) returned 0
	[0145.891] GdipDeleteFont (font=0x7550e68) returned 0x0
	[0145.897] CloseHandle (hObject=0x40) returned 1
	[0145.922] RegCloseKey (hKey=0x80000004) returned 0x0
	[0145.923] RegCloseKey (hKey=0x25c) returned 0x0
	[0145.924] RegCloseKey (hKey=0x260) returned 0x0
	[0145.925] RegCloseKey (hKey=0x258) returned 0x0
	[0145.926] CloseHandle (hObject=0x394) returned 1
	[0145.927] CloseHandle (hObject=0x174) returned 1
	[0145.928] CloseHandle (hObject=0x444) returned 1
	[0145.931] CloseHandle (hObject=0x340) returned 1
	[0145.931] RegCloseKey (hKey=0x344) returned 0x0
	[0145.933] RegCloseKey (hKey=0x360) returned 0x0
	[0145.934] RegCloseKey (hKey=0x364) returned 0x0
	[0146.006] CoGetContextToken (in: pToken=0x442f1d4 | out: pToken=0x442f1d4) returned 0x0
	[0146.006] CoGetContextToken (in: pToken=0x442f158 | out: pToken=0x442f158) returned 0x0
	[0146.006] WbemLocator:IUnknown:Release (This=0xa80c78) returned 0x1
	[0146.006] WbemLocator:IUnknown:Release (This=0xa80c78) returned 0x0
	[0146.006] CoGetContextToken (in: pToken=0x442f158 | out: pToken=0x442f158) returned 0x0
	[0146.006] WbemLocator:IUnknown:Release (This=0xa704d0) returned 0x4
	[0146.009] CoReleaseMarshalData (pStm=0xa7bc68) returned 0x0
	[0146.009] WbemLocator:IUnknown:Release (This=0xa704d0) returned 0x3
	[0146.009] WbemLocator:IUnknown:Release (This=0xa704d0) returned 0x2
	[0146.009] WbemLocator:IUnknown:Release (This=0xa704d0) returned 0x1
	[0146.009] WbemLocator:IUnknown:Release (This=0xa704d0) returned 0x0
	[0146.052] IUnknown:Release (This=0x9ffb70) returned 0x0
	[0146.052] CoGetContextToken (in: pToken=0x442f1d4 | out: pToken=0x442f1d4) returned 0x0
	[0146.052] CoGetContextToken (in: pToken=0x442f158 | out: pToken=0x442f158) returned 0x0
	[0146.052] WbemDefPath:IUnknown:Release (This=0xa1b688) returned 0x1
	[0146.052] WbemDefPath:IUnknown:Release (This=0xa1b688) returned 0x0
	[0146.052] CoGetContextToken (in: pToken=0x442f158 | out: pToken=0x442f158) returned 0x0
	[0146.052] WbemDefPath:IUnknown:Release (This=0xa1b7d8) returned 0x1
	[0146.052] WbemDefPath:IUnknown:Release (This=0xa1b7d8) returned 0x0
	[0146.053] CoGetContextToken (in: pToken=0x442f1d4 | out: pToken=0x442f1d4) returned 0x0
	[0146.053] IUnknown:QueryInterface (in: This=0x9ffa00, riid=0x72588ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x442f174 | out: ppvObject=0x442f174*=0x9ffa10) returned 0x0
	[0146.053] CObjectContext::ContextCallback () returned 0x0
	[0146.055] IUnknown:Release (This=0x9ffa10) returned 0x1
	[0146.055] IUnknown:Release (This=0x9ffa00) returned 0x0

Thread:
	id = 4
	os_tid = 0xf5c


Thread:
	id = 5
	os_tid = 0xf70


Thread:
	id = 6
	os_tid = 0xf94


Thread:
	id = 7
	os_tid = 0xf98


Thread:
	id = 8
	os_tid = 0xfb0


Thread:
	id = 13
	os_tid = 0xfd8

	[0135.178] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0135.726] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x80df3cc | out: lpiid=0x80df3cc) returned 0x0
	[0135.730] CoGetClassObject (in: rclsid=0xa7b4a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x80df0e8 | out: ppv=0x80df0e8*=0xa80c38) returned 0x0
	[0137.720] WbemDefPath:IUnknown:QueryInterface (in: This=0xa80c38, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x80df300 | out: ppvObject=0x80df300*=0x0) returned 0x80004002
	[0137.720] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa80c38, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80df30c | out: ppvObject=0x80df30c*=0xa1b688) returned 0x0
	[0137.721] WbemDefPath:IUnknown:Release (This=0xa80c38) returned 0x0
	[0137.721] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b688, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80def2c | out: ppvObject=0x80def2c*=0xa1b688) returned 0x0
	[0137.723] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b688, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x80deee0 | out: ppvObject=0x80deee0*=0x0) returned 0x80004002
	[0137.723] WbemDefPath:IUnknown:AddRef (This=0xa1b688) returned 0x3
	[0137.723] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b688, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x80de83c | out: ppvObject=0x80de83c*=0x0) returned 0x80004002
	[0137.723] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b688, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x80de7ec | out: ppvObject=0x80de7ec*=0x0) returned 0x80004002
	[0137.723] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b688, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80de7f8 | out: ppvObject=0x80de7f8*=0xa80c48) returned 0x0
	[0137.723] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa80c48, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x80de800 | out: pCid=0x80de800*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0137.723] WbemDefPath:IUnknown:Release (This=0xa80c48) returned 0x3
	[0137.724] CoGetContextToken (in: pToken=0x80de858 | out: pToken=0x80de858) returned 0x0
	[0137.725] CoGetContextToken (in: pToken=0x80dec6c | out: pToken=0x80dec6c) returned 0x0
	[0137.725] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b688, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80decec | out: ppvObject=0x80decec*=0x0) returned 0x80004002
	[0137.725] WbemDefPath:IUnknown:Release (This=0xa1b688) returned 0x2
	[0137.725] WbemDefPath:IUnknown:Release (This=0xa1b688) returned 0x1
	[0137.726] SetEvent (hEvent=0x340) returned 1
	[0144.925] CoGetClassObject (in: rclsid=0xa7b4a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x80df0e8 | out: ppv=0x80df0e8*=0xaa79a0) returned 0x0
	[0144.925] WbemDefPath:IUnknown:QueryInterface (in: This=0xaa79a0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x80df300 | out: ppvObject=0x80df300*=0x0) returned 0x80004002
	[0144.925] WbemDefPath:IClassFactory:CreateInstance (in: This=0xaa79a0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80df30c | out: ppvObject=0x80df30c*=0xa1b7d8) returned 0x0
	[0144.925] WbemDefPath:IUnknown:Release (This=0xaa79a0) returned 0x0
	[0144.925] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b7d8, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80def2c | out: ppvObject=0x80def2c*=0xa1b7d8) returned 0x0
	[0144.925] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b7d8, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x80deee0 | out: ppvObject=0x80deee0*=0x0) returned 0x80004002
	[0144.926] WbemDefPath:IUnknown:AddRef (This=0xa1b7d8) returned 0x3
	[0144.926] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b7d8, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x80de83c | out: ppvObject=0x80de83c*=0x0) returned 0x80004002
	[0144.926] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b7d8, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x80de7ec | out: ppvObject=0x80de7ec*=0x0) returned 0x80004002
	[0144.926] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b7d8, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80de7f8 | out: ppvObject=0x80de7f8*=0xaa79b0) returned 0x0
	[0144.926] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xaa79b0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x80de800 | out: pCid=0x80de800*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0144.926] WbemDefPath:IUnknown:Release (This=0xaa79b0) returned 0x3
	[0144.926] CoGetContextToken (in: pToken=0x80de858 | out: pToken=0x80de858) returned 0x0
	[0144.927] CoGetContextToken (in: pToken=0x80dec6c | out: pToken=0x80dec6c) returned 0x0
	[0144.927] WbemDefPath:IUnknown:QueryInterface (in: This=0xa1b7d8, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80decec | out: ppvObject=0x80decec*=0x0) returned 0x80004002
	[0144.927] WbemDefPath:IUnknown:Release (This=0xa1b7d8) returned 0x2
	[0144.927] WbemDefPath:IUnknown:Release (This=0xa1b7d8) returned 0x1
	[0144.927] SetEvent (hEvent=0x444) returned 1

Thread:
	id = 14
	os_tid = 0xfdc


Thread:
	id = 15
	os_tid = 0xfe0

	[0137.871] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0137.872] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x835f074 | out: lpiid=0x835f074) returned 0x0
	[0137.874] CoGetClassObject (in: rclsid=0xa5d3c4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x835ed90 | out: ppv=0x835ed90*=0xa83cf0) returned 0x0
	[0138.248] WbemLocator:IUnknown:QueryInterface (in: This=0xa83cf0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x835efa8 | out: ppvObject=0x835efa8*=0x0) returned 0x80004002
	[0138.248] WbemLocator:IClassFactory:CreateInstance (in: This=0xa83cf0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x835efb4 | out: ppvObject=0x835efb4*=0xa80c78) returned 0x0
	[0138.248] WbemLocator:IUnknown:Release (This=0xa83cf0) returned 0x0
	[0138.249] WbemLocator:IUnknown:QueryInterface (in: This=0xa80c78, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x835ebd4 | out: ppvObject=0x835ebd4*=0xa80c78) returned 0x0
	[0138.249] WbemLocator:IUnknown:QueryInterface (in: This=0xa80c78, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x835eb88 | out: ppvObject=0x835eb88*=0x0) returned 0x80004002
	[0138.249] WbemLocator:IUnknown:AddRef (This=0xa80c78) returned 0x3
	[0138.249] WbemLocator:IUnknown:QueryInterface (in: This=0xa80c78, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x835e4e4 | out: ppvObject=0x835e4e4*=0x0) returned 0x80004002
	[0138.249] WbemLocator:IUnknown:QueryInterface (in: This=0xa80c78, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x835e494 | out: ppvObject=0x835e494*=0x0) returned 0x80004002
	[0138.250] WbemLocator:IUnknown:QueryInterface (in: This=0xa80c78, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x835e4a0 | out: ppvObject=0x835e4a0*=0x0) returned 0x80004002
	[0138.250] CoGetContextToken (in: pToken=0x835e500 | out: pToken=0x835e500) returned 0x0
	[0138.251] CoGetObjectContext (in: riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xa83cf4 | out: ppv=0xa83cf4*=0x9ffb70) returned 0x0
	[0138.295] CoGetContextToken (in: pToken=0x835e914 | out: pToken=0x835e914) returned 0x0
	[0138.296] WbemLocator:IUnknown:QueryInterface (in: This=0xa80c78, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x835e994 | out: ppvObject=0x835e994*=0x0) returned 0x80004002
	[0138.296] WbemLocator:IUnknown:Release (This=0xa80c78) returned 0x2
	[0138.296] WbemLocator:IUnknown:Release (This=0xa80c78) returned 0x1
	[0138.296] CoGetContextToken (in: pToken=0x835ef8c | out: pToken=0x835ef8c) returned 0x0
	[0138.296] CoGetContextToken (in: pToken=0x835eeec | out: pToken=0x835eeec) returned 0x0
	[0138.297] WbemLocator:IUnknown:QueryInterface (in: This=0xa80c78, riid=0x835efbc*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x835efb8 | out: ppvObject=0x835efb8*=0xa80c78) returned 0x0
	[0138.297] WbemLocator:IUnknown:AddRef (This=0xa80c78) returned 0x3
	[0138.297] WbemLocator:IUnknown:Release (This=0xa80c78) returned 0x2
	[0138.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa1b688, puCount=0x835f14c | out: puCount=0x835f14c*=0x2) returned 0x0
	[0138.303] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=8, puBuffLength=0x835f148*=0x0, pszText=0x0 | out: puBuffLength=0x835f148*=0xf, pszText=0x0) returned 0x0
	[0138.304] WbemDefPath:IWbemPath:GetText (in: This=0xa1b688, lFlags=8, puBuffLength=0x835f148*=0xf, pszText="00000000000000" | out: puBuffLength=0x835f148*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0
	[0138.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x835e370, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
	[0138.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x835e898, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63
	[0138.323] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x70390000
	[0138.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x835e8cc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecuritymôl1$_\x11Dþ<r¨ë5\x08\x01", lpUsedDefaultChar=0x0) returned 13
	[0138.670] GetProcAddress (hModule=0x70390000, lpProcName="ResetSecurity") returned 0x70397dd0
	[0138.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x835e8cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11
	[0138.673] GetProcAddress (hModule=0x70390000, lpProcName="SetSecurity") returned 0x70397e20
	[0138.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x835e8c8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 18
	[0138.685] GetProcAddress (hModule=0x70390000, lpProcName="BlessIWbemServices") returned 0x70396e70
	[0138.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x835e8c0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 24
	[0138.715] GetProcAddress (hModule=0x70390000, lpProcName="BlessIWbemServicesObject") returned 0x70396ed0
	[0138.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x835e8c8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandlemôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 17
	[0138.740] GetProcAddress (hModule=0x70390000, lpProcName="GetPropertyHandle") returned 0x70397820
	[0138.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x835e8c8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 18
	[0138.751] GetProcAddress (hModule=0x70390000, lpProcName="WritePropertyValue") returned 0x70397fa0
	[0138.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x835e8d4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonemôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 5
	[0138.764] GetProcAddress (hModule=0x70390000, lpProcName="Clone") returned 0x70396f30
	[0138.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x835e8c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15
	[0138.775] GetProcAddress (hModule=0x70390000, lpProcName="VerifyClientKey") returned 0x70397f20
	[0138.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x835e8c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15
	[0138.785] GetProcAddress (hModule=0x70390000, lpProcName="GetQualifierSet") returned 0x703978e0
	[0138.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x835e8d4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3
	[0138.787] GetProcAddress (hModule=0x70390000, lpProcName="Get") returned 0x703975c0
	[0138.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x835e8d4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3
	[0138.804] GetProcAddress (hModule=0x70390000, lpProcName="Put") returned 0x70397a00
	[0138.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x835e8d4, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleteôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 6
	[0138.819] GetProcAddress (hModule=0x70390000, lpProcName="Delete") returned 0x70397300
	[0138.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x835e8d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 8
	[0138.841] GetProcAddress (hModule=0x70390000, lpProcName="GetNames") returned 0x703977c0
	[0138.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x835e8c8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 16
	[0138.866] GetProcAddress (hModule=0x70390000, lpProcName="BeginEnumeration") returned 0x70396e30
	[0138.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x835e8d4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 4
	[0138.878] GetProcAddress (hModule=0x70390000, lpProcName="Next") returned 0x703979a0
	[0138.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x835e8cc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 14
	[0138.928] GetProcAddress (hModule=0x70390000, lpProcName="EndEnumeration") returned 0x703973c0
	[0138.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x835e8c0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23
	[0138.941] GetProcAddress (hModule=0x70390000, lpProcName="GetPropertyQualifierSet") returned 0x703978b0
	[0138.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x835e8d4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonemôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 5
	[0138.955] GetProcAddress (hModule=0x70390000, lpProcName="Clone") returned 0x70396f30
	[0138.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x835e8cc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectTextmôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 13
	[0138.956] GetProcAddress (hModule=0x70390000, lpProcName="GetObjectText") returned 0x703977f0
	[0139.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x835e8c8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClassmôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 17
	[0139.010] GetProcAddress (hModule=0x70390000, lpProcName="SpawnDerivedClass") returned 0x70397e80
	[0139.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x835e8cc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstancemôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 13
	[0139.019] GetProcAddress (hModule=0x70390000, lpProcName="SpawnInstance") returned 0x70397eb0
	[0139.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x835e8d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTomôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 9
	[0139.021] GetProcAddress (hModule=0x70390000, lpProcName="CompareTo") returned 0x70397020
	[0139.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x835e8c8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOriginmôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 17
	[0139.031] GetProcAddress (hModule=0x70390000, lpProcName="GetPropertyOrigin") returned 0x70397880
	[0139.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x835e8cc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 12
	[0139.064] GetProcAddress (hModule=0x70390000, lpProcName="InheritsFrom") returned 0x70397900
	[0139.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x835e8d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodmôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 9
	[0139.068] GetProcAddress (hModule=0x70390000, lpProcName="GetMethod") returned 0x70397730
	[0139.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x835e8d0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethodmôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 9
	[0139.083] GetProcAddress (hModule=0x70390000, lpProcName="PutMethod") returned 0x70397bf0
	[0139.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x835e8cc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 12
	[0139.098] GetProcAddress (hModule=0x70390000, lpProcName="DeleteMethod") returned 0x70397320
	[0139.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x835e8c4, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 22
	[0139.102] GetProcAddress (hModule=0x70390000, lpProcName="BeginMethodEnumeration") returned 0x70396e50
	[0139.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x835e8d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 10
	[0139.105] GetProcAddress (hModule=0x70390000, lpProcName="NextMethod") returned 0x703979d0
	[0139.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x835e8c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 20
	[0139.133] GetProcAddress (hModule=0x70390000, lpProcName="EndMethodEnumeration") returned 0x703973e0
	[0139.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x835e8c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSetmôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 21
	[0139.136] GetProcAddress (hModule=0x70390000, lpProcName="GetMethodQualifierSet") returned 0x70397790
	[0139.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x835e8c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15
	[0139.140] GetProcAddress (hModule=0x70390000, lpProcName="GetMethodOrigin") returned 0x70397760
	[0139.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x835e8c8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 16
	[0139.144] GetProcAddress (hModule=0x70390000, lpProcName="QualifierSet_Get") returned 0x70397c80
	[0139.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x835e8c8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 16
	[0139.180] GetProcAddress (hModule=0x70390000, lpProcName="QualifierSet_Put") returned 0x70397d10
	[0139.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x835e8c4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19
	[0139.325] GetProcAddress (hModule=0x70390000, lpProcName="QualifierSet_Delete") returned 0x70397c40
	[0139.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x835e8c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNamesmôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 21
	[0139.328] GetProcAddress (hModule=0x70390000, lpProcName="QualifierSet_GetNames") returned 0x70397cb0
	[0139.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x835e8bc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumerationmôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 29
	[0139.349] GetProcAddress (hModule=0x70390000, lpProcName="QualifierSet_BeginEnumeration") returned 0x70397c20
	[0139.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x835e8c8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Nextmôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 17
	[0139.353] GetProcAddress (hModule=0x70390000, lpProcName="QualifierSet_Next") returned 0x70397ce0
	[0139.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x835e8bc, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27
	[0139.405] GetProcAddress (hModule=0x70390000, lpProcName="QualifierSet_EndEnumeration") returned 0x70397c60
	[0139.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x835e8c0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23
	[0139.408] GetProcAddress (hModule=0x70390000, lpProcName="GetCurrentApartmentType") returned 0x703978e0
	[0139.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x835e8c4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 20
	[0139.418] GetProcAddress (hModule=0x70390000, lpProcName="GetDemultiplexedStub") returned 0x703975f0
	[0139.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x835e8c4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmimôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 21
	[0139.437] GetProcAddress (hModule=0x70390000, lpProcName="CreateInstanceEnumWmi") returned 0x70397230
	[0139.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x835e8c8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 18
	[0139.492] GetProcAddress (hModule=0x70390000, lpProcName="CreateClassEnumWmi") returned 0x70397160
	[0139.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x835e8cc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 12
	[0139.495] GetProcAddress (hModule=0x70390000, lpProcName="ExecQueryWmi") returned 0x703974e0
	[0139.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x835e8c0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 24
	[0139.541] GetProcAddress (hModule=0x70390000, lpProcName="ExecNotificationQueryWmi") returned 0x70397400
	[0139.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x835e8cc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 14
	[0139.544] GetProcAddress (hModule=0x70390000, lpProcName="PutInstanceWmi") returned 0x70397b10
	[0139.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x835e8cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11
	[0139.573] GetProcAddress (hModule=0x70390000, lpProcName="PutClassWmi") returned 0x70397a30
	[0139.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x835e8c0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 24
	[0139.590] GetProcAddress (hModule=0x70390000, lpProcName="CloneEnumWbemClassObject") returned 0x70396f50
	[0139.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x835e8c8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 16
	[0139.628] GetProcAddress (hModule=0x70390000, lpProcName="ConnectServerWmi") returned 0x70397050
	[0139.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetErrorInfo", cchWideChar=12, lpMultiByteStr=0x835e8cc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetErrorInfo»môl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 12
	[0139.664] GetProcAddress (hModule=0x70390000, lpProcName="GetErrorInfo") returned 0x70397650
	[0139.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Initialize", cchWideChar=10, lpMultiByteStr=0x835e8d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Initializeôl1$_\x11Dþ<r¨ë5\x08", lpUsedDefaultChar=0x0) returned 10
	[0139.675] GetProcAddress (hModule=0x70390000, lpProcName="Initialize") returned 0x70397920
	[0139.686] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x835e880 | out: phkResult=0x835e880*=0x3fc) returned 0x0
	[0139.686] RegQueryValueExW (in: hKey=0x3fc, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x835e89c, lpData=0x0, lpcbData=0x835e898*=0x0 | out: lpType=0x835e89c*=0x0, lpData=0x0, lpcbData=0x835e898*=0x0) returned 0x2
	[0139.686] RegCloseKey (hKey=0x3fc) returned 0x0
	[0139.687] CoCreateInstance (in: rclsid=0x70393734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70393794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x835ef7c | out: ppv=0x835ef7c*=0xa80cc8) returned 0x0
	[0139.688] WbemLocator:IWbemLocator:ConnectServer (in: This=0xa80cc8, strNetworkResource="\\\\.\\ROOT\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x835f090 | out: ppNamespace=0x835f090*=0xa704d0) returned 0x0
	[0144.538] WbemLocator:IUnknown:QueryInterface (in: This=0xa704d0, riid=0x703935b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x835eea0 | out: ppvObject=0x835eea0*=0xa64214) returned 0x0
	[0144.538] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xa64214, pProxy=0xa704d0, pAuthnSvc=0x835eef0, pAuthzSvc=0x835eeec, pServerPrincName=0x835eee4, pAuthnLevel=0x835eee8, pImpLevel=0x835eed8, pAuthInfo=0x835eedc, pCapabilites=0x835eee0 | out: pAuthnSvc=0x835eef0*=0xa, pAuthzSvc=0x835eeec*=0x0, pServerPrincName=0x835eee4, pAuthnLevel=0x835eee8*=0x6, pImpLevel=0x835eed8*=0x2, pAuthInfo=0x835eedc, pCapabilites=0x835eee0*=0x1) returned 0x0
	[0144.538] WbemLocator:IUnknown:Release (This=0xa64214) returned 0x1
	[0144.538] WbemLocator:IUnknown:QueryInterface (in: This=0xa704d0, riid=0x703935a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x835ee94 | out: ppvObject=0x835ee94*=0xa64234) returned 0x0
	[0144.538] WbemLocator:IUnknown:QueryInterface (in: This=0xa704d0, riid=0x703935b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x835ee80 | out: ppvObject=0x835ee80*=0xa64214) returned 0x0
	[0144.538] WbemLocator:IClientSecurity:SetBlanket (This=0xa64214, pProxy=0xa704d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0144.539] WbemLocator:IUnknown:Release (This=0xa64214) returned 0x2
	[0144.539] WbemLocator:IUnknown:Release (This=0xa64234) returned 0x1
	[0144.539] CoTaskMemFree (pv=0xaa07b0) 
	[0144.539] WbemLocator:IUnknown:AddRef (This=0xa704d0) returned 0x2
	[0144.539] WbemLocator:IUnknown:Release (This=0xa80cc8) returned 0x0
	[0144.541] CoGetContextToken (in: pToken=0x835e3d4 | out: pToken=0x835e3d4) returned 0x0
	[0144.541] CoGetContextToken (in: pToken=0x835e7e4 | out: pToken=0x835e7e4) returned 0x0
	[0144.541] WbemLocator:IUnknown:QueryInterface (in: This=0xa704d0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x835e780 | out: ppvObject=0x835e780*=0xa6421c) returned 0x0
	[0144.542] WbemLocator:IRpcOptions:Query (in: This=0xa6421c, pPrx=0xa84098, dwProperty=2, pdwValue=0x835e874 | out: pdwValue=0x835e874) returned 0x80004002
	[0144.542] WbemLocator:IUnknown:Release (This=0xa6421c) returned 0x2
	[0144.543] CoGetContextToken (in: pToken=0x835edb4 | out: pToken=0x835edb4) returned 0x0
	[0144.543] CoGetContextToken (in: pToken=0x835ed14 | out: pToken=0x835ed14) returned 0x0
	[0144.543] WbemLocator:IUnknown:QueryInterface (in: This=0xa704d0, riid=0x835ede4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x835ecb0 | out: ppvObject=0x835ecb0*=0xa704d0) returned 0x0
	[0144.543] WbemLocator:IUnknown:Release (This=0xa704d0) returned 0x2
	[0144.551] SysStringLen (param_1=0x0) returned 0x0
	[0144.554] CoUninitialize () 

Thread:
	id = 70
	os_tid = 0xffc

	[0144.645] CoGetContextToken (in: pToken=0x831f560 | out: pToken=0x831f560) returned 0x0
	[0144.645] CoGetContextToken (in: pToken=0x831f54c | out: pToken=0x831f54c) returned 0x0
	[0144.646] CoGetMarshalSizeMax (in: pulSize=0x831f508, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa84098, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x831f508) returned 0x0
	[0144.649] CoMarshalInterface (pStm=0xa7bc68, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa84098, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0

Thread:
	id = 71
	os_tid = 0xacc

	[0144.664] WbemLocator:IUnknown:QueryInterface (in: This=0xa704d0, riid=0xa5dc70*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x843f110 | out: ppvObject=0x843f110*=0xa704d0) returned 0x0
	[0144.664] WbemLocator:IUnknown:QueryInterface (in: This=0xa704d0, riid=0x6ccd62ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x843f0ac | out: ppvObject=0x843f0ac*=0xa704d0) returned 0x0
	[0144.664] WbemLocator:IUnknown:QueryInterface (in: This=0xa704d0, riid=0x6ccd62ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x843f064 | out: ppvObject=0x843f064*=0xa704d0) returned 0x0

Thread:
	id = 74
	os_tid = 0xab4


Process:
	id = "2"
	image_name = "powershell.exe"
	filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"
	page_root = "0xe046000"
	os_pid = "0xfb4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xf44"
	cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe\""
	cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\"
	os_username = "Q9IATRKPRH\\kEecfMwgj"
	bitness = "32"
	os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1432
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1433
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1434
	        start_va = 0x40000
	          end_va = 0x40fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1435
	        start_va = 0x50000
	          end_va = 0x53fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 1436
	        start_va = 0x60000
	          end_va = 0x60fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 1437
	        start_va = 0xd0000
	          end_va = 0x10ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 1438
	        start_va = 0x1f0000
	          end_va = 0x22ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 1439
	        start_va = 0x1390000
	          end_va = 0x13fafff
	       monitored = 0
	     entry_point = 0x139d330
	     region_type = mapped_file
	            name = "powershell.exe"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")

Region:
	              id = 1440
	        start_va = 0x776e0000
	          end_va = 0x77888fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1441
	        start_va = 0x778c0000
	          end_va = 0x77a3ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1442
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 1443
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 1444
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 1445
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 1446
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1447
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1448
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1450
	        start_va = 0x140000
	          end_va = 0x1bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000140000"
	        filename = ""

Region:
	              id = 1451
	        start_va = 0x75130000
	          end_va = 0x75137fff
	       monitored = 0
	     entry_point = 0x751320f8
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1452
	        start_va = 0x75140000
	          end_va = 0x7519bfff
	       monitored = 0
	     entry_point = 0x7517f9f4
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1453
	        start_va = 0x751a0000
	          end_va = 0x751defff
	       monitored = 0
	     entry_point = 0x751ce088
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1454
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 0
	     entry_point = 0x774d5340
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1455
	        start_va = 0x772b0000
	          end_va = 0x773bffff
	       monitored = 0
	     entry_point = 0x772c3283
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1456
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 0
	     entry_point = 0x774d5340
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1457
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000774c0000"
	        filename = ""

Region:
	              id = 1458
	        start_va = 0x775e0000
	          end_va = 0x776d9fff
	       monitored = 0
	     entry_point = 0x775fa2c8
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1459
	        start_va = 0x775e0000
	          end_va = 0x776d9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000775e0000"
	        filename = ""

Region:
	              id = 1460
	        start_va = 0x230000
	          end_va = 0x35ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 1461
	        start_va = 0x772b0000
	          end_va = 0x773bffff
	       monitored = 0
	     entry_point = 0x772c3283
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1462
	        start_va = 0x773e0000
	          end_va = 0x77426fff
	       monitored = 0
	     entry_point = 0x773e74c1
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1463
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1464
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1465
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1466
	        start_va = 0x20000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 1467
	        start_va = 0x360000
	          end_va = 0x3c6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1468
	        start_va = 0x77180000
	          end_va = 0x7721ffff
	       monitored = 0
	     entry_point = 0x771949e5
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1469
	        start_va = 0x76b90000
	          end_va = 0x76c3bfff
	       monitored = 0
	     entry_point = 0x76b9a472
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1470
	        start_va = 0x77490000
	          end_va = 0x774a8fff
	       monitored = 0
	     entry_point = 0x77494975
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1471
	        start_va = 0x769e0000
	          end_va = 0x76acffff
	       monitored = 0
	     entry_point = 0x769f0569
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1472
	        start_va = 0x75410000
	          end_va = 0x7546ffff
	       monitored = 0
	     entry_point = 0x7542a3b3
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1473
	        start_va = 0x75400000
	          end_va = 0x7540bfff
	       monitored = 0
	     entry_point = 0x754010e1
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1474
	        start_va = 0x703d0000
	          end_va = 0x703e3fff
	       monitored = 0
	     entry_point = 0x703d1da9
	     region_type = mapped_file
	            name = "atl.dll"
	        filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll")

Region:
	              id = 1475
	        start_va = 0x766d0000
	          end_va = 0x767cffff
	       monitored = 0
	     entry_point = 0x766eb6ed
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1476
	        start_va = 0x76270000
	          end_va = 0x762fffff
	       monitored = 0
	     entry_point = 0x76286343
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1477
	        start_va = 0x77890000
	          end_va = 0x77899fff
	       monitored = 0
	     entry_point = 0x778936a0
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 1478
	        start_va = 0x76300000
	          end_va = 0x7639cfff
	       monitored = 0
	     entry_point = 0x76333fd7
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 1479
	        start_va = 0x763d0000
	          end_va = 0x7652bfff
	       monitored = 0
	     entry_point = 0x7641ba3d
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1480
	        start_va = 0x76ad0000
	          end_va = 0x76b5efff
	       monitored = 0
	     entry_point = 0x76ad3fb1
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1481
	        start_va = 0x752a0000
	          end_va = 0x752e9fff
	       monitored = 1
	     entry_point = 0x752a2e54
	     region_type = mapped_file
	            name = "mscoree.dll"
	        filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")

Region:
	              id = 1482
	        start_va = 0x3d0000
	          end_va = 0x4effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 1483
	        start_va = 0x70000
	          end_va = 0x8dfff
	       monitored = 0
	     entry_point = 0x8158f
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1484
	        start_va = 0x4f0000
	          end_va = 0x677fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004f0000"
	        filename = ""

Region:
	              id = 1485
	        start_va = 0x70000
	          end_va = 0x8dfff
	       monitored = 0
	     entry_point = 0x8158f
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1486
	        start_va = 0x77430000
	          end_va = 0x7748ffff
	       monitored = 0
	     entry_point = 0x7744158f
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1487
	        start_va = 0x77050000
	          end_va = 0x7711bfff
	       monitored = 0
	     entry_point = 0x7705168b
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 1488
	        start_va = 0x680000
	          end_va = 0x800fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000680000"
	        filename = ""

Region:
	              id = 1489
	        start_va = 0x1400000
	          end_va = 0x27fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 1491
	        start_va = 0x30000
	          end_va = 0x32fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "powershell.exe.mui"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui")

Region:
	              id = 1492
	        start_va = 0x70000
	          end_va = 0x70fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 1493
	        start_va = 0x80000
	          end_va = 0x80fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000080000"
	        filename = ""

Region:
	              id = 1494
	        start_va = 0x810000
	          end_va = 0x98ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000810000"
	        filename = ""

Region:
	              id = 1496
	        start_va = 0x3d0000
	          end_va = 0x49ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 1497
	        start_va = 0x4e0000
	          end_va = 0x4effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 1500
	        start_va = 0x75210000
	          end_va = 0x7529cfff
	       monitored = 1
	     entry_point = 0x75222860
	     region_type = mapped_file
	            name = "mscoreei.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")

Region:
	              id = 1501
	        start_va = 0x73430000
	          end_va = 0x73432fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "api-ms-win-core-synch-l1-2-0.dll"
	        filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll")

Region:
	              id = 1502
	        start_va = 0x76850000
	          end_va = 0x768a6fff
	       monitored = 0
	     entry_point = 0x76869ba6
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1503
	        start_va = 0x74400000
	          end_va = 0x74408fff
	       monitored = 0
	     entry_point = 0x74401220
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1504
	        start_va = 0x723c0000
	          end_va = 0x72b6efff
	       monitored = 1
	     entry_point = 0x723dd0d0
	     region_type = mapped_file
	            name = "clr.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")

Region:
	              id = 1505
	        start_va = 0x723c0000
	          end_va = 0x72b6efff
	       monitored = 1
	     entry_point = 0x723dd0d0
	     region_type = mapped_file
	            name = "clr.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")

Region:
	              id = 1506
	        start_va = 0x723c0000
	          end_va = 0x72b6efff
	       monitored = 1
	     entry_point = 0x723dd0d0
	     region_type = mapped_file
	            name = "clr.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")

Region:
	              id = 1507
	        start_va = 0x751f0000
	          end_va = 0x75203fff
	       monitored = 0
	     entry_point = 0x751fac00
	     region_type = mapped_file
	            name = "vcruntime140_clr0400.dll"
	        filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll")

Region:
	              id = 1508
	        start_va = 0x72310000
	          end_va = 0x723bafff
	       monitored = 0
	     entry_point = 0x723a5f20
	     region_type = mapped_file
	            name = "ucrtbase_clr0400.dll"
	        filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll")

Region:
	              id = 1509
	        start_va = 0x90000
	          end_va = 0x90fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000090000"
	        filename = ""

Region:
	              id = 1510
	        start_va = 0xa0000
	          end_va = 0xaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1511
	        start_va = 0xb0000
	          end_va = 0xbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000b0000"
	        filename = ""

Region:
	              id = 1512
	        start_va = 0xc0000
	          end_va = 0xcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000c0000"
	        filename = ""

Region:
	              id = 1513
	        start_va = 0x110000
	          end_va = 0x11ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 1514
	        start_va = 0x120000
	          end_va = 0x12ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000120000"
	        filename = ""

Region:
	              id = 1515
	        start_va = 0x130000
	          end_va = 0x13ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 1516
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1517
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 1518
	        start_va = 0x810000
	          end_va = 0x95ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000810000"
	        filename = ""

Region:
	              id = 1519
	        start_va = 0x980000
	          end_va = 0x98ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000980000"
	        filename = ""

Region:
	              id = 1520
	        start_va = 0x990000
	          end_va = 0xb8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000990000"
	        filename = ""

Region:
	              id = 1521
	        start_va = 0x880000
	          end_va = 0x8bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000880000"
	        filename = ""

Region:
	              id = 1522
	        start_va = 0x920000
	          end_va = 0x95ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000920000"
	        filename = ""

Region:
	              id = 1523
	        start_va = 0x9e0000
	          end_va = 0xa1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000009e0000"
	        filename = ""

Region:
	              id = 1524
	        start_va = 0xb50000
	          end_va = 0xb8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000b50000"
	        filename = ""

Region:
	              id = 1525
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 1526
	        start_va = 0x1e0000
	          end_va = 0x1effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 1527
	        start_va = 0x2800000
	          end_va = 0x47fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002800000"
	        filename = ""

Region:
	              id = 1528
	        start_va = 0x230000
	          end_va = 0x24ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 1529
	        start_va = 0x260000
	          end_va = 0x35ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000260000"
	        filename = ""

Region:
	              id = 1530
	        start_va = 0xa20000
	          end_va = 0xa5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000a20000"
	        filename = ""

Region:
	              id = 1531
	        start_va = 0xa60000
	          end_va = 0xa9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000a60000"
	        filename = ""

Region:
	              id = 1532
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 1533
	        start_va = 0x8d0000
	          end_va = 0x90ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008d0000"
	        filename = ""

Region:
	              id = 1534
	        start_va = 0xb00000
	          end_va = 0xb3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000b00000"
	        filename = ""

Region:
	              id = 1535
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 1542
	        start_va = 0xb90000
	          end_va = 0xe5efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1543
	        start_va = 0x70f00000
	          end_va = 0x7230afff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mscorlib.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll")

Region:
	              id = 1544
	        start_va = 0x1e0000
	          end_va = 0x1effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 1548
	        start_va = 0x3d0000
	          end_va = 0x40ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003d0000"
	        filename = ""

Region:
	              id = 1549
	        start_va = 0x460000
	          end_va = 0x49ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 1550
	        start_va = 0x250000
	          end_va = 0x25ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000250000"
	        filename = ""

Region:
	              id = 1560
	        start_va = 0x70410000
	          end_va = 0x70e64fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll")

Region:
	              id = 1561
	        start_va = 0x6eb40000
	          end_va = 0x6f357fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.core.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll")

Region:
	              id = 1562
	        start_va = 0x6cd80000
	          end_va = 0x6ce0efff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.powershell.consolehost.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\731848746c032af3ce33577b793c9b9c\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\731848746c032af3ce33577b793c9b9c\\microsoft.powershell.consolehost.ni.dll")

Region:
	              id = 1563
	        start_va = 0x74190000
	          end_va = 0x741a6fff
	       monitored = 0
	     entry_point = 0x74193573
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 1564
	        start_va = 0x410000
	          end_va = 0x44bfff
	       monitored = 0
	     entry_point = 0x41128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 1565
	        start_va = 0x410000
	          end_va = 0x44bfff
	       monitored = 0
	     entry_point = 0x41128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 1566
	        start_va = 0x410000
	          end_va = 0x44bfff
	       monitored = 0
	     entry_point = 0x41128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 1567
	        start_va = 0x410000
	          end_va = 0x44bfff
	       monitored = 0
	     entry_point = 0x41128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 1568
	        start_va = 0x410000
	          end_va = 0x44bfff
	       monitored = 0
	     entry_point = 0x41128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 1569
	        start_va = 0x74150000
	          end_va = 0x7418afff
	       monitored = 0
	     entry_point = 0x7415128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 2212
	        start_va = 0x6b1c0000
	          end_va = 0x6cca2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.management.automation.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\system.management.automation.ni.dll")

Region:
	              id = 2239
	        start_va = 0x810000
	          end_va = 0x871fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mscorrc.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll")

Region:
	              id = 2240
	        start_va = 0xab0000
	          end_va = 0xaeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ab0000"
	        filename = ""

Region:
	              id = 2241
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 2242
	        start_va = 0xed0000
	          end_va = 0xf0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ed0000"
	        filename = ""

Region:
	              id = 2243
	        start_va = 0xf10000
	          end_va = 0xf4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f10000"
	        filename = ""

Region:
	              id = 2244
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 2245
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 2246
	        start_va = 0x70ed0000
	          end_va = 0x70ee2fff
	       monitored = 1
	     entry_point = 0x70edd900
	     region_type = mapped_file
	            name = "nlssorting.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")

Region:
	              id = 2247
	        start_va = 0xf50000
	          end_va = 0x1221fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nlp"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp")

Region:
	              id = 2248
	        start_va = 0x6d5c0000
	          end_va = 0x6dccbfff
	       monitored = 1
	     entry_point = 0x6dbdf392
	     region_type = mapped_file
	            name = "system.management.automation.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll")

Region:
	              id = 2249
	        start_va = 0x1230000
	          end_va = 0x12effff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2250
	        start_va = 0x6ceb0000
	          end_va = 0x6d5bbfff
	       monitored = 1
	     entry_point = 0x6d4cf392
	     region_type = mapped_file
	            name = "system.management.automation.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll")

Region:
	              id = 2251
	        start_va = 0x76ca0000
	          end_va = 0x76ca4fff
	       monitored = 0
	     entry_point = 0x76ca1438
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 2252
	        start_va = 0x755b0000
	          end_va = 0x761f9fff
	       monitored = 0
	     entry_point = 0x75631601
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 2253
	        start_va = 0x410000
	          end_va = 0x410fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000410000"
	        filename = ""

Region:
	              id = 2254
	        start_va = 0x763a0000
	          end_va = 0x763cefff
	       monitored = 0
	     entry_point = 0x763a2a35
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")

Region:
	              id = 2255
	        start_va = 0x768b0000
	          end_va = 0x769d0fff
	       monitored = 0
	     entry_point = 0x768b158e
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 2256
	        start_va = 0x766c0000
	          end_va = 0x766cbfff
	       monitored = 0
	     entry_point = 0x766c238e
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 2257
	        start_va = 0x420000
	          end_va = 0x427fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.powershell.utility.psm1"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")

Region:
	              id = 2258
	        start_va = 0x990000
	          end_va = 0x9cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000990000"
	        filename = ""

Region:
	              id = 2259
	        start_va = 0x4890000
	          end_va = 0x48cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004890000"
	        filename = ""

Region:
	              id = 2260
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 2261
	        start_va = 0x751e0000
	          end_va = 0x751e7fff
	       monitored = 0
	     entry_point = 0x751e3bf5
	     region_type = mapped_file
	            name = "msisip.dll"
	        filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll")

Region:
	              id = 2262
	        start_va = 0x48d0000
	          end_va = 0x4ccffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000048d0000"
	        filename = ""

Region:
	              id = 2263
	        start_va = 0x430000
	          end_va = 0x437fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.powershell.utility.psm1"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")

Region:
	              id = 2264
	        start_va = 0x48d0000
	          end_va = 0x4ccffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000048d0000"
	        filename = ""

Region:
	              id = 2265
	        start_va = 0x4a0000
	          end_va = 0x4dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 2266
	        start_va = 0x49d0000
	          end_va = 0x4a0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049d0000"
	        filename = ""

Region:
	              id = 2267
	        start_va = 0x70e90000
	          end_va = 0x70ea5fff
	       monitored = 0
	     entry_point = 0x70e913df
	     region_type = mapped_file
	            name = "wshext.dll"
	        filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll")

Region:
	              id = 2268
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 2269
	        start_va = 0x6f680000
	          end_va = 0x6f703fff
	       monitored = 0
	     entry_point = 0x6f6819a9
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 2270
	        start_va = 0x4a10000
	          end_va = 0x4b2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a10000"
	        filename = ""

Region:
	              id = 2271
	        start_va = 0x70e80000
	          end_va = 0x70e89fff
	       monitored = 0
	     entry_point = 0x70e84ab0
	     region_type = mapped_file
	            name = "pwrshsip.dll"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll")

Region:
	              id = 2272
	        start_va = 0x4900000
	          end_va = 0x493ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004900000"
	        filename = ""

Region:
	              id = 2273
	        start_va = 0x4aa0000
	          end_va = 0x4adffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004aa0000"
	        filename = ""

Region:
	              id = 2274
	        start_va = 0x4b20000
	          end_va = 0x4b2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b20000"
	        filename = ""

Region:
	              id = 2275
	        start_va = 0x7ef9e000
	          end_va = 0x7efa0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9e000"
	        filename = ""

Region:
	              id = 2276
	        start_va = 0x4b30000
	          end_va = 0x4c2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004b30000"
	        filename = ""

Region:
	              id = 2277
	        start_va = 0x1320000
	          end_va = 0x135ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001320000"
	        filename = ""

Region:
	              id = 2278
	        start_va = 0x4a20000
	          end_va = 0x4a5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a20000"
	        filename = ""

Region:
	              id = 2279
	        start_va = 0x7ef9b000
	          end_va = 0x7ef9dfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef9b000"
	        filename = ""

Region:
	              id = 2280
	        start_va = 0x420000
	          end_va = 0x42ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000420000"
	        filename = ""

Region:
	              id = 2281
	        start_va = 0x430000
	          end_va = 0x430fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 2282
	        start_va = 0x440000
	          end_va = 0x446fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 2283
	        start_va = 0x430000
	          end_va = 0x430fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 2284
	        start_va = 0x440000
	          end_va = 0x446fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 2285
	        start_va = 0x430000
	          end_va = 0x430fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 2286
	        start_va = 0x430000
	          end_va = 0x436fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 2287
	        start_va = 0x430000
	          end_va = 0x430fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 2288
	        start_va = 0x430000
	          end_va = 0x436fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 2289
	        start_va = 0x430000
	          end_va = 0x430fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 2290
	        start_va = 0x430000
	          end_va = 0x436fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 2291
	        start_va = 0x4980000
	          end_va = 0x49bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004980000"
	        filename = ""

Region:
	              id = 2292
	        start_va = 0x4c30000
	          end_va = 0x4c6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c30000"
	        filename = ""

Region:
	              id = 2293
	        start_va = 0x4cd0000
	          end_va = 0x4d0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004cd0000"
	        filename = ""

Region:
	              id = 2294
	        start_va = 0x4d60000
	          end_va = 0x4d9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d60000"
	        filename = ""

Region:
	              id = 2295
	        start_va = 0x7ef95000
	          end_va = 0x7ef97fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef95000"
	        filename = ""

Region:
	              id = 2296
	        start_va = 0x7ef98000
	          end_va = 0x7ef9afff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef98000"
	        filename = ""

Region:
	              id = 2297
	        start_va = 0x6d4b0000
	          end_va = 0x6dcc9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.data.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\df2dd09ed7c341842a104e1e668f184e\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.data\\df2dd09ed7c341842a104e1e668f184e\\system.data.ni.dll")

Region:
	              id = 2298
	        start_va = 0x6d150000
	          end_va = 0x6d4a3fff
	       monitored = 1
	     entry_point = 0x6d487a72
	     region_type = mapped_file
	            name = "system.data.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll")

Region:
	              id = 2299
	        start_va = 0x76200000
	          end_va = 0x76234fff
	       monitored = 0
	     entry_point = 0x7620145d
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2300
	        start_va = 0x774b0000
	          end_va = 0x774b5fff
	       monitored = 0
	     entry_point = 0x774b1782
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 2301
	        start_va = 0x4da0000
	          end_va = 0x50f0fff
	       monitored = 1
	     entry_point = 0x50d7a72
	     region_type = mapped_file
	            name = "system.data.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll")

Region:
	              id = 2302
	        start_va = 0x4da0000
	          end_va = 0x50f0fff
	       monitored = 1
	     entry_point = 0x50d7a72
	     region_type = mapped_file
	            name = "system.data.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll")

Region:
	              id = 2303
	        start_va = 0x4da0000
	          end_va = 0x50f0fff
	       monitored = 1
	     entry_point = 0x50d7a72
	     region_type = mapped_file
	            name = "system.data.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll")

Region:
	              id = 2304
	        start_va = 0x4da0000
	          end_va = 0x50f0fff
	       monitored = 1
	     entry_point = 0x50d7a72
	     region_type = mapped_file
	            name = "system.data.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll")

Region:
	              id = 2305
	        start_va = 0x430000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000430000"
	        filename = ""

Region:
	              id = 2306
	        start_va = 0x6f900000
	          end_va = 0x70073fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.xml.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll")

Region:
	              id = 2307
	        start_va = 0x6f550000
	          end_va = 0x6f67ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.management.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll")

Region:
	              id = 2308
	        start_va = 0x6f420000
	          end_va = 0x6f54bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.directoryservices.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\system.directoryservices.ni.dll")

Region:
	              id = 2342
	        start_va = 0x70ef0000
	          end_va = 0x70ef2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "api-ms-win-core-xstate-l2-1-0.dll"
	        filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll")

Region:
	              id = 2343
	        start_va = 0x70340000
	          end_va = 0x703c8fff
	       monitored = 1
	     entry_point = 0x70341130
	     region_type = mapped_file
	            name = "clrjit.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")

Region:
	              id = 2349
	        start_va = 0x440000
	          end_va = 0x44ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 2350
	        start_va = 0x450000
	          end_va = 0x45ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 2363
	        start_va = 0x6cf50000
	          end_va = 0x6cfa3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.powershell.security.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\microsoft.powershell.security.ni.dll")

Region:
	              id = 2364
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 2365
	        start_va = 0x4ae0000
	          end_va = 0x4b1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ae0000"
	        filename = ""

Region:
	              id = 2366
	        start_va = 0x6ce60000
	          end_va = 0x6cf17fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.transactions.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\3d760b4a3260a41ef84a3fd866780980\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\3d760b4a3260a41ef84a3fd866780980\\system.transactions.ni.dll")

Region:
	              id = 2367
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 2374
	        start_va = 0x6ce10000
	          end_va = 0x6ce5bfff
	       monitored = 1
	     entry_point = 0x6ce2fcc6
	     region_type = mapped_file
	            name = "system.transactions.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll")

Region:
	              id = 2375
	        start_va = 0xee0000
	          end_va = 0xf2bfff
	       monitored = 1
	     entry_point = 0xeffcc6
	     region_type = mapped_file
	            name = "system.transactions.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll")

Region:
	              id = 2377
	        start_va = 0xee0000
	          end_va = 0xf2bfff
	       monitored = 1
	     entry_point = 0xeffcc6
	     region_type = mapped_file
	            name = "system.transactions.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll")

Region:
	              id = 2378
	        start_va = 0xee0000
	          end_va = 0xf2bfff
	       monitored = 1
	     entry_point = 0xeffcc6
	     region_type = mapped_file
	            name = "system.transactions.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll")

Region:
	              id = 2379
	        start_va = 0xee0000
	          end_va = 0xf2bfff
	       monitored = 1
	     entry_point = 0xeffcc6
	     region_type = mapped_file
	            name = "system.transactions.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll")

Region:
	              id = 2386
	        start_va = 0xee0000
	          end_va = 0xf1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ee0000"
	        filename = ""

Region:
	              id = 2387
	        start_va = 0x4d10000
	          end_va = 0x4d4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d10000"
	        filename = ""

Region:
	              id = 2388
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 2390
	        start_va = 0x6cd70000
	          end_va = 0x6cd77fff
	       monitored = 0
	     entry_point = 0x6cd710e9
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll")

Region:
	              id = 2394
	        start_va = 0x70080000
	          end_va = 0x70184fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.configuration.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll")

Region:
	              id = 2407
	        start_va = 0x4800000
	          end_va = 0x487ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004800000"
	        filename = ""

Region:
	              id = 2421
	        start_va = 0x6ccf0000
	          end_va = 0x6cd6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.management.infrastructure.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\microsoft.management.infrastructure.ni.dll")

Region:
	              id = 2422
	        start_va = 0x6b170000
	          end_va = 0x6b1b6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.numerics.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\e7d6ed984300c7212c6e682c4f730b1e\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.numerics\\e7d6ed984300c7212c6e682c4f730b1e\\system.numerics.ni.dll")

Region:
	              id = 2424
	        start_va = 0x8c0000
	          end_va = 0x8cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008c0000"
	        filename = ""

Region:
	              id = 2428
	        start_va = 0x910000
	          end_va = 0x91ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000910000"
	        filename = ""

Region:
	              id = 2435
	        start_va = 0x960000
	          end_va = 0x96ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000960000"
	        filename = ""

Region:
	              id = 2436
	        start_va = 0x970000
	          end_va = 0x97ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000970000"
	        filename = ""

Region:
	              id = 2437
	        start_va = 0x9d0000
	          end_va = 0x9dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000009d0000"
	        filename = ""

Region:
	              id = 2438
	        start_va = 0xaa0000
	          end_va = 0xaaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000aa0000"
	        filename = ""

Region:
	              id = 2439
	        start_va = 0xaf0000
	          end_va = 0xafffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000af0000"
	        filename = ""

Region:
	              id = 2440
	        start_va = 0xb40000
	          end_va = 0xb4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000b40000"
	        filename = ""

Region:
	              id = 2441
	        start_va = 0xea0000
	          end_va = 0xeaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 2442
	        start_va = 0xeb0000
	          end_va = 0xebffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000eb0000"
	        filename = ""

Region:
	              id = 2443
	        start_va = 0xec0000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 2444
	        start_va = 0xed0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ed0000"
	        filename = ""

Region:
	              id = 2445
	        start_va = 0xee0000
	          end_va = 0xeeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ee0000"
	        filename = ""

Region:
	              id = 2526
	        start_va = 0x6afd0000
	          end_va = 0x6b167fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.csharp.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\f73f48afb5512225dedaee9c88ac5050\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\f73f48afb5512225dedaee9c88ac5050\\microsoft.csharp.ni.dll")

Region:
	              id = 2530
	        start_va = 0xef0000
	          end_va = 0xefffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ef0000"
	        filename = ""

Region:
	              id = 2531
	        start_va = 0xf00000
	          end_va = 0xf0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f00000"
	        filename = ""

Region:
	              id = 2532
	        start_va = 0xf10000
	          end_va = 0xf1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f10000"
	        filename = ""

Region:
	              id = 2533
	        start_va = 0xf10000
	          end_va = 0xf1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f10000"
	        filename = ""

Region:
	              id = 2534
	        start_va = 0xf20000
	          end_va = 0xf2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f20000"
	        filename = ""

Region:
	              id = 2535
	        start_va = 0x4e20000
	          end_va = 0x4e5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e20000"
	        filename = ""

Region:
	              id = 2536
	        start_va = 0x4ee0000
	          end_va = 0x586ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ee0000"
	        filename = ""

Region:
	              id = 2537
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 2538
	        start_va = 0x74320000
	          end_va = 0x7439ffff
	       monitored = 0
	     entry_point = 0x743337c9
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 2539
	        start_va = 0x5870000
	          end_va = 0x596ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005870000"
	        filename = ""

Region:
	              id = 2540
	        start_va = 0x5970000
	          end_va = 0x5a4efff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005970000"
	        filename = ""

Region:
	              id = 2541
	        start_va = 0x4e90000
	          end_va = 0x4ecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e90000"
	        filename = ""

Region:
	              id = 2542
	        start_va = 0x58f0000
	          end_va = 0x592ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058f0000"
	        filename = ""

Region:
	              id = 2543
	        start_va = 0x5930000
	          end_va = 0x596ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005930000"
	        filename = ""

Region:
	              id = 2544
	        start_va = 0x7ef92000
	          end_va = 0x7ef94fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef92000"
	        filename = ""

Region:
	              id = 2545
	        start_va = 0x74300000
	          end_va = 0x7430dfff
	       monitored = 0
	     entry_point = 0x74301235
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 2546
	        start_va = 0x4c80000
	          end_va = 0x4cbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c80000"
	        filename = ""

Region:
	              id = 2547
	        start_va = 0x4dc0000
	          end_va = 0x4dfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004dc0000"
	        filename = ""

Region:
	              id = 2548
	        start_va = 0x7ef8f000
	          end_va = 0x7ef91fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8f000"
	        filename = ""

Region:
	              id = 2549
	        start_va = 0x4940000
	          end_va = 0x497ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004940000"
	        filename = ""

Region:
	              id = 2550
	        start_va = 0x5ab0000
	          end_va = 0x5aeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ab0000"
	        filename = ""

Region:
	              id = 2551
	        start_va = 0x7ef8c000
	          end_va = 0x7ef8efff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef8c000"
	        filename = ""

Region:
	              id = 2552
	        start_va = 0xf20000
	          end_va = 0xf2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f20000"
	        filename = ""

Region:
	              id = 2553
	        start_va = 0x5a60000
	          end_va = 0x5a9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a60000"
	        filename = ""

Region:
	              id = 2554
	        start_va = 0x5b10000
	          end_va = 0x5b4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005b10000"
	        filename = ""

Region:
	              id = 2555
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 2556
	        start_va = 0x5b50000
	          end_va = 0x5c4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005b50000"
	        filename = ""

Region:
	              id = 2557
	        start_va = 0x5870000
	          end_va = 0x58affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005870000"
	        filename = ""

Region:
	              id = 2558
	        start_va = 0x5c60000
	          end_va = 0x5c9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005c60000"
	        filename = ""

Region:
	              id = 2559
	        start_va = 0x7ef86000
	          end_va = 0x7ef88fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef86000"
	        filename = ""

Region:
	              id = 2560
	        start_va = 0xf30000
	          end_va = 0xf40fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000f30000"
	        filename = ""

Region:
	              id = 2561
	        start_va = 0x12f0000
	          end_va = 0x12f1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "powershellget.psd1"
	        filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")

Region:
	              id = 2562
	        start_va = 0x5ca0000
	          end_va = 0x609ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005ca0000"
	        filename = ""

Region:
	              id = 2563
	        start_va = 0x1300000
	          end_va = 0x1301fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "powershellget.psd1"
	        filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")

Region:
	              id = 2564
	        start_va = 0x5ca0000
	          end_va = 0x609ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005ca0000"
	        filename = ""

Region:
	              id = 2565
	        start_va = 0x12f0000
	          end_va = 0x12f0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bitstransfer.psd1"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")

Region:
	              id = 2566
	        start_va = 0x5ca0000
	          end_va = 0x609ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005ca0000"
	        filename = ""

Region:
	              id = 2567
	        start_va = 0x1300000
	          end_va = 0x1300fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "bitstransfer.psd1"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")

Region:
	              id = 2568
	        start_va = 0x5ca0000
	          end_va = 0x609ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005ca0000"
	        filename = ""

Region:
	              id = 2569
	        start_va = 0x12f0000
	          end_va = 0x12f0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.powershell.management.psd1"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")

Region:
	              id = 2570
	        start_va = 0x5db0000
	          end_va = 0x5deffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005db0000"
	        filename = ""

Region:
	              id = 2571
	        start_va = 0x5e20000
	          end_va = 0x5e5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e20000"
	        filename = ""

Region:
	              id = 2572
	        start_va = 0x7ef89000
	          end_va = 0x7ef8bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef89000"
	        filename = ""

Region:
	              id = 2573
	        start_va = 0x5e60000
	          end_va = 0x625ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005e60000"
	        filename = ""

Region:
	              id = 2574
	        start_va = 0x1300000
	          end_va = 0x1300fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.powershell.management.psd1"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")

Region:
	              id = 2575
	        start_va = 0x5e60000
	          end_va = 0x625ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005e60000"
	        filename = ""

Region:
	              id = 2576
	        start_va = 0x6adf0000
	          end_va = 0x6afc6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.powershell.commands.management.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\microsoft.powershell.commands.management.ni.dll")

Region:
	              id = 2577
	        start_va = 0x6ccc0000
	          end_va = 0x6cce7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.configuration.install.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\system.configuration.install.ni.dll")

Region:
	              id = 2578
	        start_va = 0x12f0000
	          end_va = 0x12fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000012f0000"
	        filename = ""

Region:
	              id = 2579
	        start_va = 0x1300000
	          end_va = 0x130ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001300000"
	        filename = ""

Region:
	              id = 2580
	        start_va = 0x58b0000
	          end_va = 0x58effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058b0000"
	        filename = ""

Region:
	              id = 2581
	        start_va = 0x5ca0000
	          end_va = 0x5cdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ca0000"
	        filename = ""

Region:
	              id = 2582
	        start_va = 0x1300000
	          end_va = 0x130ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001300000"
	        filename = ""

Region:
	              id = 2583
	        start_va = 0x1310000
	          end_va = 0x131ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001310000"
	        filename = ""

Region:
	              id = 2584
	        start_va = 0x1360000
	          end_va = 0x136ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001360000"
	        filename = ""

Region:
	              id = 2585
	        start_va = 0x7ef30000
	          end_va = 0x7ef7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef30000"
	        filename = ""

Region:
	              id = 2586
	        start_va = 0x7ef20000
	          end_va = 0x7ef2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef20000"
	        filename = ""

Region:
	              id = 2587
	        start_va = 0x6ad60000
	          end_va = 0x6ade3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.management.infrastructure.native.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.M870d558a#\\7ceb6b903321c16b12386a8df1be50f9\\Microsoft.Management.Infrastructure.Native.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.m870d558a#\\7ceb6b903321c16b12386a8df1be50f9\\microsoft.management.infrastructure.native.ni.dll")

Region:
	              id = 2588
	        start_va = 0x6ad40000
	          end_va = 0x6ad51fff
	       monitored = 0
	     entry_point = 0x6ad4cdae
	     region_type = mapped_file
	            name = "microsoft.backgroundintelligenttransfer.management.dll"
	        filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.BackgroundIntelligentTransfer.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.BackgroundIntelligentTransfer.Management.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.backgroundintelligenttransfer.management\\1.0.0.0__31bf3856ad364e35\\microsoft.backgroundintelligenttransfer.management.dll")

Region:
	              id = 2589
	        start_va = 0x1370000
	          end_va = 0x1381fff
	       monitored = 0
	     entry_point = 0x137cdae
	     region_type = mapped_file
	            name = "microsoft.backgroundintelligenttransfer.management.dll"
	        filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.BackgroundIntelligentTransfer.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.BackgroundIntelligentTransfer.Management.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.backgroundintelligenttransfer.management\\1.0.0.0__31bf3856ad364e35\\microsoft.backgroundintelligenttransfer.management.dll")

Region:
	              id = 2590
	        start_va = 0x4880000
	          end_va = 0x488ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004880000"
	        filename = ""

Region:
	              id = 2591
	        start_va = 0x48d0000
	          end_va = 0x48d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "psdiagnostics.psd1"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")

Region:
	              id = 2592
	        start_va = 0x5ce0000
	          end_va = 0x60dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005ce0000"
	        filename = ""

Region:
	              id = 2593
	        start_va = 0x48e0000
	          end_va = 0x48e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "psdiagnostics.psd1"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")

Region:
	              id = 2594
	        start_va = 0x5ce0000
	          end_va = 0x60dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005ce0000"
	        filename = ""

Region:
	              id = 2595
	        start_va = 0x5d20000
	          end_va = 0x5d5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d20000"
	        filename = ""

Region:
	              id = 2596
	        start_va = 0x5d70000
	          end_va = 0x5daffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d70000"
	        filename = ""

Region:
	              id = 2597
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 2598
	        start_va = 0x48d0000
	          end_va = 0x48d5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "troubleshootingpack.psd1"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")

Region:
	              id = 2599
	        start_va = 0x5db0000
	          end_va = 0x61affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005db0000"
	        filename = ""

Region:
	              id = 2600
	        start_va = 0x48e0000
	          end_va = 0x48e5fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "troubleshootingpack.psd1"
	        filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")

Region:
	              id = 2601
	        start_va = 0x5db0000
	          end_va = 0x61affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000005db0000"
	        filename = ""

Region:
	              id = 2602
	        start_va = 0x48d0000
	          end_va = 0x48d9fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "crypt32.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui")

Region:
	              id = 2603
	        start_va = 0x6ad00000
	          end_va = 0x6ad37fff
	       monitored = 0
	     entry_point = 0x6ad01489
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")

Region:
	              id = 2604
	        start_va = 0x70eb0000
	          end_va = 0x70ec6fff
	       monitored = 0
	     entry_point = 0x70eb35fa
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2605
	        start_va = 0x6acc0000
	          end_va = 0x6acfcfff
	       monitored = 0
	     entry_point = 0x6acc10f5
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2606
	        start_va = 0x6aca0000
	          end_va = 0x6acb6fff
	       monitored = 0
	     entry_point = 0x6aca1c9d
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll")

Region:
	              id = 2607
	        start_va = 0x744c0000
	          end_va = 0x744cafff
	       monitored = 0
	     entry_point = 0x744c1992
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 2608
	        start_va = 0x5db0000
	          end_va = 0x5faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005db0000"
	        filename = ""

Region:
	              id = 2609
	        start_va = 0x6ac80000
	          end_va = 0x6ac95fff
	       monitored = 0
	     entry_point = 0x6ac82061
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll")

Region:
	              id = 2610
	        start_va = 0x703f0000
	          end_va = 0x703fffff
	       monitored = 0
	     entry_point = 0x703fa5ce
	     region_type = mapped_file
	            name = "microsoft.windows.diagnosis.troubleshootingpack.dll"
	        filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.troubleshootingpack\\6.1.0.0__31bf3856ad364e35\\microsoft.windows.diagnosis.troubleshootingpack.dll")

Region:
	              id = 2611
	        start_va = 0x48e0000
	          end_va = 0x48effff
	       monitored = 0
	     entry_point = 0x48ea5ce
	     region_type = mapped_file
	            name = "microsoft.windows.diagnosis.troubleshootingpack.dll"
	        filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.troubleshootingpack\\6.1.0.0__31bf3856ad364e35\\microsoft.windows.diagnosis.troubleshootingpack.dll")

Region:
	              id = 2612
	        start_va = 0x6ccb0000
	          end_va = 0x6ccb7fff
	       monitored = 0
	     entry_point = 0x6ccb378e
	     region_type = mapped_file
	            name = "microsoft.windows.diagnosis.sdengine.dll"
	        filename = "\\Windows\\assembly\\GAC_32\\Microsoft.Windows.Diagnosis.SDEngine\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDEngine.dll" (normalized: "c:\\windows\\assembly\\gac_32\\microsoft.windows.diagnosis.sdengine\\6.1.0.0__31bf3856ad364e35\\microsoft.windows.diagnosis.sdengine.dll")

Region:
	              id = 2613
	        start_va = 0x48f0000
	          end_va = 0x48f7fff
	       monitored = 0
	     entry_point = 0x48f378e
	     region_type = mapped_file
	            name = "microsoft.windows.diagnosis.sdengine.dll"
	        filename = "\\Windows\\assembly\\GAC_32\\Microsoft.Windows.Diagnosis.SDEngine\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDEngine.dll" (normalized: "c:\\windows\\assembly\\gac_32\\microsoft.windows.diagnosis.sdengine\\6.1.0.0__31bf3856ad364e35\\microsoft.windows.diagnosis.sdengine.dll")

Region:
	              id = 2614
	        start_va = 0x6ab70000
	          end_va = 0x6ac74fff
	       monitored = 1
	     entry_point = 0x6aba9680
	     region_type = mapped_file
	            name = "diasymreader.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\diasymreader.dll")

Region:
	              id = 2615
	        start_va = 0x4d10000
	          end_va = 0x4d4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d10000"
	        filename = ""

Region:
	              id = 2616
	        start_va = 0x5a70000
	          end_va = 0x5aaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a70000"
	        filename = ""

Region:
	              id = 2617
	        start_va = 0x7ef83000
	          end_va = 0x7ef85fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef83000"
	        filename = ""

Region:
	              id = 2618
	        start_va = 0x49c0000
	          end_va = 0x49cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""

Region:
	              id = 2619
	        start_va = 0x49c0000
	          end_va = 0x49cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""

Region:
	              id = 2620
	        start_va = 0x49c0000
	          end_va = 0x49cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""

Region:
	              id = 2621
	        start_va = 0x49c0000
	          end_va = 0x49cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""

Region:
	              id = 2622
	        start_va = 0x49c0000
	          end_va = 0x49cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""

Region:
	              id = 2623
	        start_va = 0x49c0000
	          end_va = 0x49cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""

Region:
	              id = 2624
	        start_va = 0x49c0000
	          end_va = 0x49cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""

Region:
	              id = 2790
	        start_va = 0x49c0000
	          end_va = 0x49cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000049c0000"
	        filename = ""


Thread:
	id = 9
	os_tid = 0xfb8

	[0186.742] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x434
	[0186.742] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x430
	[0186.743] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x440
	[0186.743] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x22c
	[0186.744] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x458
	[0186.744] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x450
	[0186.744] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x608
	[0186.745] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x61c
	[0186.745] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x60c
	[0186.746] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x620
	[0186.746] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x624
	[0186.746] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x610
	[0186.746] SetEvent (hEvent=0x22c) returned 1
	[0186.746] SetEvent (hEvent=0x434) returned 1
	[0186.747] SetEvent (hEvent=0x430) returned 1
	[0186.747] SetEvent (hEvent=0x440) returned 1
	[0186.747] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x628
	[0186.747] SetEvent (hEvent=0x364) returned 1
	[0186.766] SetEvent (hEvent=0x458) returned 1
	[0186.766] SetEvent (hEvent=0x450) returned 1
	[0186.766] SetEvent (hEvent=0x608) returned 1
	[0186.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x10d9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40
	[0186.860] CoTaskMemAlloc (cb=0x20c) returned 0x5b60b80
	[0186.860] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5b60b80, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39
	[0186.860] CoTaskMemFree (pv=0x5b60b80) 
	[0186.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a
	[0186.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39
	[0186.873] GetCurrentProcess () returned 0xffffffff
	[0186.873] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x10dce0 | out: TokenHandle=0x10dce0*=0x62c) returned 1
	[0186.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f
	[0186.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
	[0186.880] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x10dcd8 | out: lpFileInformation=0x10dcd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1
	[0186.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44
	[0186.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0186.884] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x10dce0 | out: lpFileInformation=0x10dce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1
	[0186.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44
	[0186.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0186.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10dc18) returned 1
	[0186.885] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x630
	[0186.885] GetFileType (hFile=0x630) returned 0x1
	[0186.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10dc14) returned 1
	[0186.885] GetFileType (hFile=0x630) returned 0x1
	[0186.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44
	[0186.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43
	[0186.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44
	[0186.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43
	[0186.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10d1f4) returned 1
	[0186.907] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x10d4b8 | out: lpFileInformation=0x10d4b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1
	[0186.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10d1f0) returned 1
	[0187.027] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x10d384 | out: pfEnabled=0x10d384) returned 0x0
	[0187.048] GetFileSize (in: hFile=0x630, lpFileSizeHigh=0x10dcd4 | out: lpFileSizeHigh=0x10dcd4*=0x0) returned 0x8c8e
	[0187.049] ReadFile (in: hFile=0x630, lpBuffer=0x2bc7790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10dc90, lpOverlapped=0x0 | out: lpBuffer=0x2bc7790*, lpNumberOfBytesRead=0x10dc90*=0x1000, lpOverlapped=0x0) returned 1
	[0187.076] ReadFile (in: hFile=0x630, lpBuffer=0x2bc7790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10db40, lpOverlapped=0x0 | out: lpBuffer=0x2bc7790*, lpNumberOfBytesRead=0x10db40*=0x1000, lpOverlapped=0x0) returned 1
	[0187.080] ReadFile (in: hFile=0x630, lpBuffer=0x2bc7790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10d9f4, lpOverlapped=0x0 | out: lpBuffer=0x2bc7790*, lpNumberOfBytesRead=0x10d9f4*=0x1000, lpOverlapped=0x0) returned 1
	[0187.081] ReadFile (in: hFile=0x630, lpBuffer=0x2bc7790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10d9f4, lpOverlapped=0x0 | out: lpBuffer=0x2bc7790*, lpNumberOfBytesRead=0x10d9f4*=0x1000, lpOverlapped=0x0) returned 1
	[0187.082] ReadFile (in: hFile=0x630, lpBuffer=0x2bc7790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10d9f4, lpOverlapped=0x0 | out: lpBuffer=0x2bc7790*, lpNumberOfBytesRead=0x10d9f4*=0x1000, lpOverlapped=0x0) returned 1
	[0187.082] ReadFile (in: hFile=0x630, lpBuffer=0x2bc7790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10d92c, lpOverlapped=0x0 | out: lpBuffer=0x2bc7790*, lpNumberOfBytesRead=0x10d92c*=0x1000, lpOverlapped=0x0) returned 1
	[0187.096] ReadFile (in: hFile=0x630, lpBuffer=0x2bc7790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10da98, lpOverlapped=0x0 | out: lpBuffer=0x2bc7790*, lpNumberOfBytesRead=0x10da98*=0x1000, lpOverlapped=0x0) returned 1
	[0187.099] ReadFile (in: hFile=0x630, lpBuffer=0x2bc7790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10d98c, lpOverlapped=0x0 | out: lpBuffer=0x2bc7790*, lpNumberOfBytesRead=0x10d98c*=0x1000, lpOverlapped=0x0) returned 1
	[0187.099] ReadFile (in: hFile=0x630, lpBuffer=0x2bc7790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10d98c, lpOverlapped=0x0 | out: lpBuffer=0x2bc7790*, lpNumberOfBytesRead=0x10d98c*=0xc8e, lpOverlapped=0x0) returned 1
	[0187.100] ReadFile (in: hFile=0x630, lpBuffer=0x2bc7790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10da50, lpOverlapped=0x0 | out: lpBuffer=0x2bc7790*, lpNumberOfBytesRead=0x10da50*=0x0, lpOverlapped=0x0) returned 1
	[0187.100] CloseHandle (hObject=0x630) returned 1
	[0187.100] CloseHandle (hObject=0x62c) returned 1
	[0187.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x10d9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40
	[0187.101] CoTaskMemAlloc (cb=0x20c) returned 0x5b60b80
	[0187.101] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5b60b80, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39
	[0187.101] CoTaskMemFree (pv=0x5b60b80) 
	[0187.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a
	[0187.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39
	[0187.102] GetCurrentProcess () returned 0xffffffff
	[0187.102] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x10de2c | out: TokenHandle=0x10de2c*=0x62c) returned 1
	[0187.103] CloseHandle (hObject=0x62c) returned 1
	[0187.103] GetCurrentProcess () returned 0xffffffff
	[0187.104] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x10de2c | out: TokenHandle=0x10de2c*=0x62c) returned 1
	[0187.104] CloseHandle (hObject=0x62c) returned 1
	[0187.107] GetCurrentProcess () returned 0xffffffff
	[0187.107] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x10dce0 | out: TokenHandle=0x10dce0*=0x62c) returned 1
	[0187.108] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x10dcd8 | out: lpFileInformation=0x10dcd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.108] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41
	[0187.108] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40
	[0187.109] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x10dce0 | out: lpFileInformation=0x10dce0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.109] CloseHandle (hObject=0x62c) returned 1
	[0187.110] GetCurrentProcess () returned 0xffffffff
	[0187.110] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x10de2c | out: TokenHandle=0x10de2c*=0x62c) returned 1
	[0187.111] CloseHandle (hObject=0x62c) returned 1
	[0187.113] GetCurrentProcess () returned 0xffffffff
	[0187.113] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x10de2c | out: TokenHandle=0x10de2c*=0x62c) returned 1
	[0187.114] CloseHandle (hObject=0x62c) returned 1
	[0187.140] GetCurrentProcess () returned 0xffffffff
	[0187.141] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x10dc44 | out: TokenHandle=0x10dc44*=0x62c) returned 1
	[0187.176] CloseHandle (hObject=0x62c) returned 1
	[0187.177] GetCurrentProcess () returned 0xffffffff
	[0187.177] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x10dc5c | out: TokenHandle=0x10dc5c*=0x62c) returned 1
	[0187.179] CloseHandle (hObject=0x62c) returned 1
	[0187.190] CoCreateGuid (in: pguid=0x10e048 | out: pguid=0x10e048*(Data1=0x58ab5129, Data2=0x51fa, Data3=0x4808, Data4=([0]=0x88, [1]=0x23, [2]=0x2a, [3]=0x9a, [4]=0xa3, [5]=0xbb, [6]=0x79, [7]=0x0))) returned 0x0
	[0187.193] ReportEventW (hEventLog=0x4800004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2be53d0*="Stopped", lpRawData=0x2be52f8) returned 1
	[0187.212] SetEvent (hEvent=0x364) returned 1
	[0187.265] CloseHandle (hObject=0x364) returned 1
	[0187.426] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1
	[0187.433] CoGetContextToken (in: pToken=0x10f714 | out: pToken=0x10f714) returned 0x0
	[0187.433] IUnknown:QueryInterface (in: This=0x2b0af0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x10f738 | out: ppvObject=0x10f738*=0x2b0afc) returned 0x0
	[0187.433] IComThreadingInfo:GetCurrentThreadType (in: This=0x2b0afc, pThreadType=0x10f798 | out: pThreadType=0x10f798*=0) returned 0x0
	[0187.433] IUnknown:Release (This=0x2b0afc) returned 0x0
	[0187.435] CoGetContextToken (in: pToken=0x10f424 | out: pToken=0x10f424) returned 0x0
	[0187.435] IUnknown:QueryInterface (in: This=0x2b0af0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x10f448 | out: ppvObject=0x10f448*=0x2b0afc) returned 0x0
	[0187.435] IComThreadingInfo:GetCurrentThreadType (in: This=0x2b0afc, pThreadType=0x10f474 | out: pThreadType=0x10f474*=0) returned 0x0
	[0187.435] IUnknown:Release (This=0x2b0afc) returned 0x0
	[0187.438] CoGetContextToken (in: pToken=0x10f424 | out: pToken=0x10f424) returned 0x0
	[0187.438] IUnknown:QueryInterface (in: This=0x2b0af0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x10f448 | out: ppvObject=0x10f448*=0x2b0afc) returned 0x0
	[0187.438] IComThreadingInfo:GetCurrentThreadType (in: This=0x2b0afc, pThreadType=0x10f474 | out: pThreadType=0x10f474*=0) returned 0x0
	[0187.440] IUnknown:Release (This=0x2b0afc) returned 0x0
	[0187.505] CoGetContextToken (in: pToken=0x10f424 | out: pToken=0x10f424) returned 0x0
	[0187.505] IUnknown:QueryInterface (in: This=0x2b0af0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x10f448 | out: ppvObject=0x10f448*=0x2b0afc) returned 0x0
	[0187.505] IComThreadingInfo:GetCurrentThreadType (in: This=0x2b0afc, pThreadType=0x10f474 | out: pThreadType=0x10f474*=0) returned 0x0
	[0187.505] IUnknown:Release (This=0x2b0afc) returned 0x0
	[0187.520] CoGetContextToken (in: pToken=0x10f444 | out: pToken=0x10f444) returned 0x0
	[0187.520] IUnknown:QueryInterface (in: This=0x2b0af0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x10f468 | out: ppvObject=0x10f468*=0x2b0afc) returned 0x0
	[0187.520] IComThreadingInfo:GetCurrentThreadType (in: This=0x2b0afc, pThreadType=0x10f494 | out: pThreadType=0x10f494*=0) returned 0x0
	[0187.520] IUnknown:Release (This=0x2b0afc) returned 0x0
	[0187.521] CoUninitialize () 

Thread:
	id = 10
	os_tid = 0xfcc


Thread:
	id = 11
	os_tid = 0xfd0

	[0173.361] RegCloseKey (hKey=0x360) returned 0x0
	[0175.579] CloseHandle (hObject=0x3ec) returned 1
	[0175.579] CloseHandle (hObject=0x3fc) returned 1
	[0175.579] CloseHandle (hObject=0x3f8) returned 1
	[0175.580] CloseHandle (hObject=0x3f4) returned 1
	[0175.580] CloseHandle (hObject=0x3f0) returned 1
	[0179.392] CoGetContextToken (in: pToken=0xa5fba4 | out: pToken=0xa5fba4) returned 0x0
	[0179.392] IUnknown:QueryInterface (in: This=0x2b0c60, riid=0x72588ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xa5fb44 | out: ppvObject=0xa5fb44*=0x2b0c70) returned 0x0
	[0179.392] CObjectContext::ContextCallback () returned 0x0
	[0181.548] IUnknown:Release (This=0x2b0c70) returned 0x1
	[0181.548] CloseHandle (hObject=0x450) returned 1
	[0181.548] CloseHandle (hObject=0x44c) returned 1
	[0181.548] CloseHandle (hObject=0x444) returned 1
	[0181.549] CloseHandle (hObject=0x458) returned 1
	[0181.549] CloseHandle (hObject=0x454) returned 1
	[0181.889] EtwEventUnregister () returned 0x0
	[0181.896] RegCloseKey (hKey=0x80000004) returned 0x0
	[0181.897] CoGetContextToken (in: pToken=0xa5fb64 | out: pToken=0xa5fb64) returned 0x0
	[0181.898] IUnknown:QueryInterface (in: This=0x2b0c60, riid=0x72588ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xa5fb04 | out: ppvObject=0xa5fb04*=0x2b0c70) returned 0x0
	[0181.898] CObjectContext::ContextCallback () returned 0x0
	[0181.899] IUnknown:Release (This=0x2b0c70) returned 0x1
	[0181.899] IUnknown:Release (This=0x2b0c60) returned 0x0
	[0181.976] CloseHandle (hObject=0x464) returned 1
	[0181.976] CloseHandle (hObject=0x46c) returned 1
	[0181.976] CertFreeCRLContext (pCrlContext=0x5b67530) returned 1
	[0181.978] CloseHandle (hObject=0x468) returned 1
	[0181.978] CertFreeCRLContext (pCrlContext=0x5b674e0) returned 1
	[0181.978] CloseHandle (hObject=0x474) returned 1
	[0181.978] CloseHandle (hObject=0x470) returned 1
	[0187.435] EtwEventUnregister () returned 0x0
	[0187.436] EtwEventUnregister () returned 0x0
	[0187.436] EtwEventUnregister () returned 0x0
	[0187.436] EtwEventUnregister () returned 0x0
	[0187.436] EtwEventUnregister () returned 0x0
	[0187.436] EtwEventUnregister () returned 0x0
	[0187.436] EtwEventUnregister () returned 0x0
	[0187.436] EtwEventUnregister () returned 0x0
	[0187.458] LocalFree (hMem=0x2cb4b8) returned 0x0
	[0187.459] LocalFree (hMem=0x2cbd38) returned 0x0
	[0187.471] EtwEventUnregister () returned 0x0
	[0187.480] CloseHandle (hObject=0x2d4) returned 1
	[0187.494] CloseHandle (hObject=0x350) returned 1
	[0187.494] CloseHandle (hObject=0x34c) returned 1
	[0187.495] CloseHandle (hObject=0x348) returned 1
	[0187.495] CloseHandle (hObject=0x344) returned 1
	[0187.495] CloseHandle (hObject=0x340) returned 1
	[0187.496] CloseHandle (hObject=0x33c) returned 1
	[0187.496] CloseHandle (hObject=0x338) returned 1
	[0187.497] CloseHandle (hObject=0x330) returned 1
	[0187.497] CloseHandle (hObject=0x2cc) returned 1
	[0187.497] CloseHandle (hObject=0x318) returned 1
	[0187.498] CloseHandle (hObject=0x61c) returned 1
	[0187.498] CloseHandle (hObject=0x608) returned 1
	[0187.499] CloseHandle (hObject=0x450) returned 1
	[0187.499] CloseHandle (hObject=0x458) returned 1
	[0187.499] CloseHandle (hObject=0x22c) returned 1
	[0187.500] CloseHandle (hObject=0x440) returned 1
	[0187.500] CloseHandle (hObject=0x430) returned 1
	[0187.500] CloseHandle (hObject=0x3cc) returned 1
	[0187.501] LocalFree (hMem=0x332e70) returned 0x0
	[0187.501] UnmapViewOfFile (lpBaseAddress=0xf30000) returned 1
	[0187.503] CloseHandle (hObject=0x434) returned 1
	[0187.503] CloseHandle (hObject=0x464) returned 1
	[0187.504] CloseHandle (hObject=0xf) returned 1
	[0187.508] DeregisterEventSource (hEventLog=0x4800004) returned 1
	[0187.511] CloseHandle (hObject=0x40c) returned 1
	[0187.511] CloseHandle (hObject=0x408) returned 1
	[0187.511] CloseHandle (hObject=0x360) returned 1
	[0187.512] CloseHandle (hObject=0x404) returned 1
	[0187.512] CloseHandle (hObject=0x3c0) returned 1
	[0187.513] CloseHandle (hObject=0x418) returned 1
	[0187.513] CloseHandle (hObject=0x414) returned 1
	[0187.513] CloseHandle (hObject=0x41c) returned 1
	[0187.514] CloseHandle (hObject=0x228) returned 1
	[0187.514] CloseHandle (hObject=0x424) returned 1
	[0187.514] CloseHandle (hObject=0x420) returned 1
	[0187.515] LocalFree (hMem=0x358ee8) returned 0x0
	[0187.515] CloseHandle (hObject=0x628) returned 1
	[0187.516] CloseHandle (hObject=0x610) returned 1
	[0187.516] CloseHandle (hObject=0x624) returned 1
	[0187.516] RegCloseKey (hKey=0x80000004) returned 0x0
	[0187.517] CloseHandle (hObject=0x620) returned 1
	[0187.517] CloseHandle (hObject=0x60c) returned 1
	[0187.518] CloseHandle (hObject=0x35c) returned 1
	[0187.518] CloseHandle (hObject=0x358) returned 1
	[0187.518] CloseHandle (hObject=0x354) returned 1

Thread:
	id = 12
	os_tid = 0xfd4


Thread:
	id = 78
	os_tid = 0xa94


Thread:
	id = 79
	os_tid = 0xa90


Thread:
	id = 80
	os_tid = 0xad4


Thread:
	id = 81
	os_tid = 0xa8c


Thread:
	id = 82
	os_tid = 0xad0

	[0171.965] CoCreateGuid (in: pguid=0x4adeda0 | out: pguid=0x4adeda0*(Data1=0xfb7d04f1, Data2=0x2e4, Data3=0x4600, Data4=([0]=0xbc, [1]=0x84, [2]=0x15, [3]=0x6c, [4]=0xc, [5]=0x21, [6]=0x99, [7]=0x47))) returned 0x0
	[0183.789] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20
	[0183.790] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20
	[0183.790] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20
	[0183.791] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20
	[0183.791] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20
	[0183.791] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow\\PSWorkflow.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflow\\psworkflow.psd1")) returned 0xffffffff
	[0183.792] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20
	[0183.792] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility\\PSWorkflowUtility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflowutility\\psworkflowutility.psd1")) returned 0xffffffff
	[0183.792] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20
	[0183.792] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager\\NetworkSwitchManager.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\networkswitchmanager\\networkswitchmanager.psd1")) returned 0xffffffff
	[0183.792] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20
	[0183.793] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20
	[0183.793] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20
	[0183.793] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0xffffffff
	[0183.793] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20
	[0183.793] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20
	[0183.793] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20
	[0183.794] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psm1")) returned 0x20
	[0183.794] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20
	[0183.794] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20
	[0183.794] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\\Microsoft.PowerShell.LocalAccounts.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.localaccounts\\1.0.0.0\\microsoft.powershell.localaccounts.psd1")) returned 0xffffffff
	[0183.794] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20
	[0183.797] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20
	[0183.797] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20
	[0183.798] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20
	[0183.798] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20
	[0183.798] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20

Thread:
	id = 83
	os_tid = 0xa88


Thread:
	id = 84
	os_tid = 0xa84

	[0187.482] CoGetContextToken (in: pToken=0x4d9f504 | out: pToken=0x4d9f504) returned 0x0
	[0187.483] IUnknown:QueryInterface (in: This=0x2b0af0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4d9f528 | out: ppvObject=0x4d9f528*=0x2b0afc) returned 0x0
	[0187.483] IComThreadingInfo:GetCurrentThreadType (in: This=0x2b0afc, pThreadType=0x4d9f554 | out: pThreadType=0x4d9f554*=0) returned 0x0
	[0187.483] IUnknown:Release (This=0x2b0afc) returned 0x0

Thread:
	id = 85
	os_tid = 0xa80


Thread:
	id = 96
	os_tid = 0xb00


Thread:
	id = 99
	os_tid = 0xb04


Thread:
	id = 105
	os_tid = 0xae0

	[0171.764] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0171.779] EtwEventRegister () returned 0x0
	[0171.854] CoCreateGuid (in: pguid=0x586eeac | out: pguid=0x586eeac*(Data1=0xe41fa2cb, Data2=0x8ba, Data3=0x46f1, Data4=([0]=0x9c, [1]=0x71, [2]=0x1b, [3]=0x0, [4]=0xfe, [5]=0x7d, [6]=0x5d, [7]=0x95))) returned 0x0
	[0171.865] QueryPerformanceCounter (in: lpPerformanceCount=0x586ee8c | out: lpPerformanceCount=0x586ee8c*=2531607756374) returned 1
	[0171.866] GetCurrentProcessId () returned 0xfb4
	[0171.867] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfb4) returned 0x3c0
	[0171.867] EnumProcessModules (in: hProcess=0x3c0, lphModule=0x2ac9298, cb=0x100, lpcbNeeded=0x586ed84 | out: lphModule=0x2ac9298, lpcbNeeded=0x586ed84) returned 1
	[0171.868] GetModuleInformation (in: hProcess=0x3c0, hModule=0x1390000, lpmodinfo=0x2ac93d8, cb=0xc | out: lpmodinfo=0x2ac93d8*(lpBaseOfDll=0x1390000, SizeOfImage=0x6b000, EntryPoint=0x139d330)) returned 1
	[0171.868] CoTaskMemAlloc (cb=0x804) returned 0x3581d0
	[0171.869] GetModuleBaseNameW (in: hProcess=0x3c0, hModule=0x1390000, lpBaseName=0x3581d0, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe
	[0171.869] CoTaskMemFree (pv=0x3581d0) 
	[0171.869] CoTaskMemAlloc (cb=0x804) returned 0x3581d0
	[0171.869] GetModuleFileNameExW (in: hProcess=0x3c0, hModule=0x1390000, lpFilename=0x3581d0, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39
	[0171.869] CoTaskMemFree (pv=0x3581d0) 
	[0171.869] CloseHandle (hObject=0x3c0) returned 1
	[0171.870] LocalReAlloc (hMem=0x30afc0, uBytes=0x208, uFlags=0x2) returned 0x358ee8
	[0171.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39
	[0171.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586eabc) returned 1
	[0171.871] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x586ed80 | out: lpFileInformation=0x586ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f9180, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8b7f9180, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x7711b3a3, ftLastWriteTime.dwHighDateTime=0x1d251bc, nFileSizeHigh=0x0, nFileSizeLow=0x68400)) returned 1
	[0171.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586eab8) returned 1
	[0171.871] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x586edf4 | out: lpdwHandle=0x586edf4) returned 0x74c
	[0171.872] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x74c, lpData=0x2acb60c | out: lpData=0x2acb60c) returned 1
	[0171.872] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x586edc8, puLen=0x586edc4 | out: lplpBuffer=0x586edc8*=0x2acb9ac, puLen=0x586edc4) returned 1
	[0171.872] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x2acb6c4, puLen=0x586ed44) returned 1
	[0171.872] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x2acb718, puLen=0x586ed44) returned 1
	[0171.872] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x2acb760, puLen=0x586ed44) returned 1
	[0171.872] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x2acb7d4, puLen=0x586ed44) returned 1
	[0171.872] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x2acb810, puLen=0x586ed44) returned 1
	[0171.872] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x2acb894, puLen=0x586ed44) returned 1
	[0171.872] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x2acb8dc, puLen=0x586ed44) returned 1
	[0171.872] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x2acb94c, puLen=0x586ed44) returned 1
	[0171.872] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x0, puLen=0x586ed44) returned 0
	[0171.873] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x0, puLen=0x586ed44) returned 0
	[0171.873] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x0, puLen=0x586ed44) returned 0
	[0171.873] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x586ed48, puLen=0x586ed44 | out: lplpBuffer=0x586ed48*=0x0, puLen=0x586ed44) returned 0
	[0171.873] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x586ed3c, puLen=0x586ed38 | out: lplpBuffer=0x586ed3c*=0x2acb9ac, puLen=0x586ed38) returned 1
	[0171.873] VerLanguageNameW (in: wLang=0x409, szLang=0x586eacc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
	[0171.873] VerQueryValueW (in: pBlock=0x2acb60c, lpSubBlock="\\", lplpBuffer=0x586ed4c, puLen=0x586ed48 | out: lplpBuffer=0x586ed4c*=0x2acb634, puLen=0x586ed48) returned 1
	[0172.167] QueryPerformanceCounter (in: lpPerformanceCount=0x586ee54 | out: lpPerformanceCount=0x586ee54*=2531637902233) returned 1
	[0172.192] EtwEventRegister () returned 0x0
	[0172.192] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x586ecc4, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0172.306] EtwEventActivityIdControl () returned 0x0
	[0172.306] EtwEventActivityIdControl () returned 0x0
	[0172.306] EtwEventActivityIdControl () returned 0x0
	[0172.314] EtwEventActivityIdControl () returned 0x0
	[0172.315] EtwEventActivityIdControl () returned 0x0
	[0172.315] EtwEventActivityIdControl () returned 0x0
	[0172.418] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x586e4cc, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0172.419] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x586e4cc, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0172.435] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x586e4b8, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0172.478] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x586ed30 | out: phkResult=0x586ed30*=0x0) returned 0x2
	[0172.479] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x586ed30 | out: phkResult=0x586ed30*=0x0) returned 0x2
	[0172.482] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x586e488, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0172.495] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x586e8c8, nSize=0x80 | out: lpBuffer="") returned 0x0
	[0172.498] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x586e7e4, nSize=0x80 | out: lpBuffer="") returned 0xbe
	[0172.498] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x586e768, nSize=0xbe | out: lpBuffer="") returned 0xbd
	[0172.500] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x586e754, nSize=0xbe | out: lpBuffer="") returned 0x3a
	[0172.537] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x358ee8 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a
	[0172.541] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x586e75c, nSize=0xbe | out: lpBuffer="") returned 0x3a
	[0172.542] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49
	[0172.542] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48
	[0172.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e650) returned 1
	[0172.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x586e914 | out: lpFileInformation=0x586e914*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e64c) returned 1
	[0172.543] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x586dfec, nSize=0xbe | out: lpBuffer="") returned 0x0
	[0172.544] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14
	[0172.544] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0172.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e650) returned 1
	[0172.544] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x586e914 | out: lpFileInformation=0x586e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0172.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e64c) returned 1
	[0172.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e90c) returned 1
	[0172.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14
	[0172.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0172.546] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Add-MpPreference.*", lpFindFileData=0x586e6bc | out: lpFindFileData=0x586e6bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0172.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e664) returned 1
	[0172.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e8c4) returned 1
	[0172.548] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb
	[0172.548] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
	[0172.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e650) returned 1
	[0172.548] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x586e914 | out: lpFileInformation=0x586e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0172.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e64c) returned 1
	[0172.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e90c) returned 1
	[0172.549] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb
	[0172.549] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
	[0172.549] FindFirstFileW (in: lpFileName="C:\\Windows\\Add-MpPreference.*", lpFindFileData=0x586e6bc | out: lpFindFileData=0x586e6bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0172.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e664) returned 1
	[0172.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e8c4) returned 1
	[0172.549] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19
	[0172.550] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18
	[0172.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e650) returned 1
	[0172.550] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x586e914 | out: lpFileInformation=0x586e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1
	[0172.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e64c) returned 1
	[0172.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e90c) returned 1
	[0172.550] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19
	[0172.550] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18
	[0172.550] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Add-MpPreference.*", lpFindFileData=0x586e6bc | out: lpFindFileData=0x586e6bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0172.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e664) returned 1
	[0172.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e8c4) returned 1
	[0172.551] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c
	[0172.551] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b
	[0172.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e650) returned 1
	[0172.551] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x586e914 | out: lpFileInformation=0x586e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0172.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e64c) returned 1
	[0172.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e90c) returned 1
	[0172.551] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c
	[0172.551] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b
	[0172.552] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Add-MpPreference.*", lpFindFileData=0x586e6bc | out: lpFindFileData=0x586e6bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0172.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e664) returned 1
	[0172.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e8c4) returned 1
	[0172.558] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x586e7c0, nSize=0xbe | out: lpBuffer="") returned 0xc6
	[0172.558] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x586e7b0, nSize=0xc6 | out: lpBuffer="") returned 0xc5
	[0172.577] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10
	[0172.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0172.582] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b
	[0172.582] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a
	[0172.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e9260
	[0172.585] FindNextFileW (in: hFindFile=0x2e9260, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.585] FindNextFileW (in: hFindFile=0x2e9260, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1
	[0172.585] FindNextFileW (in: hFindFile=0x2e9260, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1
	[0172.585] FindNextFileW (in: hFindFile=0x2e9260, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0172.585] FindClose (in: hFindFile=0x2e9260 | out: hFindFile=0x2e9260) returned 1
	[0172.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0172.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0172.586] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff
	[0172.586] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff
	[0172.587] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff
	[0172.587] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff
	[0172.587] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff
	[0172.587] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff
	[0172.588] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d
	[0172.588] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c
	[0172.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0172.588] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0172.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0172.592] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39
	[0172.592] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38
	[0172.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0172.593] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0172.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0172.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0172.593] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d
	[0172.593] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c
	[0172.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e9260
	[0172.594] FindNextFileW (in: hFindFile=0x2e9260, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.594] FindNextFileW (in: hFindFile=0x2e9260, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0172.594] FindNextFileW (in: hFindFile=0x2e9260, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0172.594] FindClose (in: hFindFile=0x2e9260 | out: hFindFile=0x2e9260) returned 1
	[0172.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0172.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0172.595] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c
	[0172.595] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b
	[0172.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e690) returned 1
	[0172.595] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586e954 | out: lpFileInformation=0x586e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1
	[0172.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e68c) returned 1
	[0172.601] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c
	[0172.601] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b
	[0172.603] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c
	[0172.603] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b
	[0172.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0172.603] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2af4d6c | out: lpFileInformation=0x2af4d6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1
	[0172.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0172.611] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x586d964, nSize=0xc6 | out: lpBuffer="") returned 0x0
	[0172.611] CoTaskMemAlloc (cb=0x20c) returned 0x35e998
	[0172.611] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x35e998 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0172.612] CoTaskMemFree (pv=0x35e998) 
	[0172.612] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21
	[0172.612] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x21, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0172.612] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020
	[0172.614] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0172.614] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51
	[0172.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e108) returned 1
	[0172.614] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8
	[0172.615] GetFileType (hFile=0x3c8) returned 0x1
	[0172.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e104) returned 1
	[0172.615] GetFileType (hFile=0x3c8) returned 0x1
	[0172.616] ReadFile (in: hFile=0x3c8, lpBuffer=0x2af5ebc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e17c, lpOverlapped=0x0 | out: lpBuffer=0x2af5ebc*, lpNumberOfBytesRead=0x586e17c*=0x1000, lpOverlapped=0x0) returned 1
	[0172.633] ReadFile (in: hFile=0x3c8, lpBuffer=0x2af5a8b, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x586e184, lpOverlapped=0x0 | out: lpBuffer=0x2af5a8b*, lpNumberOfBytesRead=0x586e184*=0x1, lpOverlapped=0x0) returned 1
	[0172.633] ReadFile (in: hFile=0x3c8, lpBuffer=0x2af5ebc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e170, lpOverlapped=0x0 | out: lpBuffer=0x2af5ebc*, lpNumberOfBytesRead=0x586e170*=0x1000, lpOverlapped=0x0) returned 1
	[0172.634] ReadFile (in: hFile=0x3c8, lpBuffer=0x2af5a89, nNumberOfBytesToRead=0x13, lpNumberOfBytesRead=0x586e184, lpOverlapped=0x0 | out: lpBuffer=0x2af5a89*, lpNumberOfBytesRead=0x586e184*=0x13, lpOverlapped=0x0) returned 1
	[0172.634] ReadFile (in: hFile=0x3c8, lpBuffer=0x2af5ebc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e184, lpOverlapped=0x0 | out: lpBuffer=0x2af5ebc*, lpNumberOfBytesRead=0x586e184*=0x1000, lpOverlapped=0x0) returned 1
	[0172.643] ReadFile (in: hFile=0x3c8, lpBuffer=0x2af5ebc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e184, lpOverlapped=0x0 | out: lpBuffer=0x2af5ebc*, lpNumberOfBytesRead=0x586e184*=0x4fd, lpOverlapped=0x0) returned 1
	[0172.644] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x586dfe4, nSize=0xc6 | out: lpBuffer="") returned 0x0
	[0172.654] CloseHandle (hObject=0x3c8) returned 1
	[0172.654] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff
	[0172.654] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff
	[0172.654] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff
	[0172.654] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff
	[0172.655] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff
	[0172.655] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff
	[0172.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0172.655] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39
	[0172.655] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38
	[0172.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0172.655] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.655] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0172.656] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0172.656] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0172.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0172.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0172.656] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0172.656] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53
	[0172.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e690) returned 1
	[0172.656] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586e954 | out: lpFileInformation=0x586e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0172.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e68c) returned 1
	[0172.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0172.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53
	[0172.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0172.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53
	[0172.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0172.660] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2b07f20 | out: lpFileInformation=0x2b07f20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0172.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0172.660] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff
	[0172.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff
	[0172.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff
	[0172.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff
	[0172.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff
	[0172.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff
	[0172.665] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff
	[0172.676] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10
	[0172.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0172.679] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31
	[0172.679] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30
	[0172.679] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0172.679] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.679] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1
	[0172.679] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1
	[0172.679] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0172.680] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0172.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0172.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0172.680] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff
	[0172.680] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff
	[0172.680] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff
	[0172.680] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff
	[0172.680] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff
	[0172.680] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff
	[0172.681] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43
	[0172.681] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42
	[0172.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0172.681] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0172.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0172.682] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f
	[0172.682] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e
	[0172.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0172.682] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0172.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0172.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0172.683] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43
	[0172.683] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42
	[0172.683] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0172.683] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.683] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0172.684] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0172.684] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0172.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0172.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0172.684] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62
	[0172.684] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61
	[0172.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e690) returned 1
	[0172.684] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586e954 | out: lpFileInformation=0x586e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1
	[0172.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e68c) returned 1
	[0172.688] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62
	[0172.688] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61
	[0172.688] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62
	[0172.688] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61
	[0172.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0172.688] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2b11ac0 | out: lpFileInformation=0x2b11ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1
	[0172.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0172.693] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62
	[0172.693] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61
	[0172.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0172.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8
	[0172.693] GetFileType (hFile=0x3c8) returned 0x1
	[0172.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0172.694] GetFileType (hFile=0x3c8) returned 0x1
	[0172.694] GetACP () returned 0x4e4
	[0172.703] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0172.703] ReadFile (in: hFile=0x3c8, lpBuffer=0x2b12d98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2b12d98*, lpNumberOfBytesRead=0x586e884*=0x8f9, lpOverlapped=0x0) returned 1
	[0172.717] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x8f9
	[0172.717] ReadFile (in: hFile=0x3c8, lpBuffer=0x2b12231, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2b12231*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0172.718] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x8f9
	[0172.718] ReadFile (in: hFile=0x3c8, lpBuffer=0x2b12d98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2b12d98*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0172.718] CloseHandle (hObject=0x3c8) returned 1
	[0172.752] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff
	[0172.752] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff
	[0172.752] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff
	[0172.752] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff
	[0172.752] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff
	[0172.752] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff
	[0172.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0172.752] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f
	[0172.753] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e
	[0172.753] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0172.753] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.753] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0172.753] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0172.753] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0172.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0172.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0172.753] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0172.754] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0172.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e690) returned 1
	[0172.754] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586e954 | out: lpFileInformation=0x586e954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0172.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e68c) returned 1
	[0172.757] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0172.757] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0172.757] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0172.757] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0172.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0172.757] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2b21ab8 | out: lpFileInformation=0x2b21ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0172.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0172.758] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0172.758] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0172.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0172.758] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3ec
	[0172.758] GetFileType (hFile=0x3ec) returned 0x1
	[0172.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0172.759] GetFileType (hFile=0x3ec) returned 0x1
	[0172.759] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0172.760] ReadFile (in: hFile=0x3ec, lpBuffer=0x2b22890, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2b22890*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0172.767] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x1000
	[0172.767] ReadFile (in: hFile=0x3ec, lpBuffer=0x2b22890, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2b22890*, lpNumberOfBytesRead=0x586e884*=0xde, lpOverlapped=0x0) returned 1
	[0172.767] SetFilePointer (in: hFile=0x3ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x10de
	[0172.767] ReadFile (in: hFile=0x3ec, lpBuffer=0x2b22890, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2b22890*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0172.768] CloseHandle (hObject=0x3ec) returned 1
	[0172.773] CoCreateGuid (in: pguid=0x586e8c4 | out: pguid=0x586e8c4*(Data1=0x50f2175c, Data2=0xca40, Data3=0x4d21, Data4=([0]=0x92, [1]=0x40, [2]=0x87, [3]=0x7b, [4]=0xc7, [5]=0x5f, [6]=0x4b, [7]=0x90))) returned 0x0
	[0172.784] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3ec
	[0172.784] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3f0
	[0172.785] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f4
	[0172.785] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f8
	[0172.785] SetEvent (hEvent=0x3f8) returned 1
	[0172.785] SetEvent (hEvent=0x3ec) returned 1
	[0172.785] SetEvent (hEvent=0x3f0) returned 1
	[0172.785] SetEvent (hEvent=0x3f4) returned 1
	[0172.788] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3fc
	[0172.788] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0172.851] EtwEventActivityIdControl () returned 0x0
	[0172.851] EtwEventActivityIdControl () returned 0x0
	[0172.851] EtwEventActivityIdControl () returned 0x0
	[0172.896] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20
	[0172.898] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0172.898] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0172.898] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586e1fc, Length=0x20, ResultLength=0x586e26c | out: SystemInformation=0x586e1fc, ResultLength=0x586e26c*=0x0) returned 0xc0000003
	[0172.899] GetSystemInfo (in: lpSystemInfo=0x586e278 | out: lpSystemInfo=0x586e278*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0172.899] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586e208 | out: phkResult=0x586e208*=0x404) returned 0x0
	[0172.900] RegQueryValueExW (in: hKey=0x404, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586e224, lpData=0x0, lpcbData=0x586e220*=0x0 | out: lpType=0x586e224*=0x0, lpData=0x0, lpcbData=0x586e220*=0x0) returned 0x2
	[0172.900] RegCloseKey (hKey=0x404) returned 0x0
	[0172.912] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0172.912] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0172.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e180) returned 1
	[0172.912] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x404
	[0172.912] GetFileType (hFile=0x404) returned 0x1
	[0172.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e17c) returned 1
	[0172.912] GetFileType (hFile=0x404) returned 0x1
	[0172.913] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x0
	[0172.913] ReadFile (in: hFile=0x404, lpBuffer=0x2b45ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2b45ea8*, lpNumberOfBytesRead=0x586e1e8*=0x1000, lpOverlapped=0x0) returned 1
	[0172.913] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x1000
	[0172.914] ReadFile (in: hFile=0x404, lpBuffer=0x2b45ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2b45ea8*, lpNumberOfBytesRead=0x586e1e8*=0xde, lpOverlapped=0x0) returned 1
	[0172.914] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x10de
	[0172.914] ReadFile (in: hFile=0x404, lpBuffer=0x2b45ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2b45ea8*, lpNumberOfBytesRead=0x586e1e8*=0x0, lpOverlapped=0x0) returned 1
	[0172.914] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586e150, Length=0x20, ResultLength=0x586e1c0 | out: SystemInformation=0x586e150, ResultLength=0x586e1c0*=0x0) returned 0xc0000003
	[0172.915] GetSystemInfo (in: lpSystemInfo=0x586e1cc | out: lpSystemInfo=0x586e1cc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0172.915] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586e15c | out: phkResult=0x586e15c*=0x408) returned 0x0
	[0172.915] RegQueryValueExW (in: hKey=0x408, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586e178, lpData=0x0, lpcbData=0x586e174*=0x0 | out: lpType=0x586e178*=0x0, lpData=0x0, lpcbData=0x586e174*=0x0) returned 0x2
	[0172.915] RegCloseKey (hKey=0x408) returned 0x0
	[0172.915] CloseHandle (hObject=0x404) returned 1
	[0172.918] CoCreateGuid (in: pguid=0x586e24c | out: pguid=0x586e24c*(Data1=0x839ac631, Data2=0xab9a, Data3=0x4b42, Data4=([0]=0x8d, [1]=0x4c, [2]=0xf, [3]=0x55, [4]=0xee, [5]=0xa6, [6]=0x32, [7]=0xdd))) returned 0x0
	[0172.924] QueryPerformanceCounter (in: lpPerformanceCount=0x586dfac | out: lpPerformanceCount=0x586dfac*=2531713580380) returned 1
	[0172.924] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0172.924] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0172.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586dc98) returned 1
	[0172.924] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586df5c | out: lpFileInformation=0x586df5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0172.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dc94) returned 1
	[0172.924] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0172.924] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0172.924] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0172.924] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0172.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586dc2c) returned 1
	[0172.925] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586def0 | out: lpFileInformation=0x586def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0172.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dc28) returned 1
	[0172.925] CoTaskMemAlloc (cb=0x10) returned 0x349ae8
	[0172.925] CoTaskMemAlloc (cb=0x10) returned 0x349b48
	[0172.925] CoTaskMemAlloc (cb=0xb4) returned 0x31c5b0
	[0172.925] CoTaskMemAlloc (cb=0x30) returned 0x3278c8
	[0172.925] WinVerifyTrust () returned 0x800b0100
	[0172.946] CoTaskMemFree (pv=0x349ae8) 
	[0172.946] CoTaskMemFree (pv=0x3278c8) 
	[0172.946] CryptCATHandleFromStore () returned 0x2d5830
	[0172.946] WTHelperGetProvSignerFromChain () returned 0x0
	[0172.946] CoTaskMemAlloc (cb=0x10) returned 0x349ae8
	[0172.946] CoTaskMemAlloc (cb=0x30) returned 0x3278c8
	[0172.946] WinVerifyTrust () returned 0x0
	[0172.946] CoTaskMemFree (pv=0x3278c8) 
	[0172.946] CoTaskMemFree (pv=0x349ae8) 
	[0172.946] CoTaskMemFree (pv=0x31c5b0) 
	[0172.946] CoTaskMemFree (pv=0x349b48) 
	[0173.073] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\powershellget.psd1")) returned 0xffffffff
	[0173.073] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en\\powershellget.psd1")) returned 0xffffffff
	[0173.088] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20
	[0173.094] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20
	[0173.099] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0173.099] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0173.099] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47
	[0173.099] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x47, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", lpFilePart=0x0) returned 0x46
	[0173.143] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d8e8 | out: phkResult=0x586d8e8*=0x404) returned 0x0
	[0173.144] RegQueryValueExW (in: hKey=0x404, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d908, lpData=0x0, lpcbData=0x586d904*=0x0 | out: lpType=0x586d908*=0x1, lpData=0x0, lpcbData=0x586d904*=0x56) returned 0x0
	[0173.144] RegQueryValueExW (in: hKey=0x404, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d908, lpData=0x2b72b64, lpcbData=0x586d904*=0x56 | out: lpType=0x586d908*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x586d904*=0x56) returned 0x0
	[0173.144] RegCloseKey (hKey=0x404) returned 0x0
	[0173.148] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20
	[0173.154] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20
	[0173.155] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20
	[0173.156] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d8e8 | out: phkResult=0x586d8e8*=0x404) returned 0x0
	[0173.156] RegQueryValueExW (in: hKey=0x404, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d908, lpData=0x0, lpcbData=0x586d904*=0x0 | out: lpType=0x586d908*=0x1, lpData=0x0, lpcbData=0x586d904*=0x56) returned 0x0
	[0173.156] RegQueryValueExW (in: hKey=0x404, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d908, lpData=0x2b80344, lpcbData=0x586d904*=0x56 | out: lpType=0x586d908*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x586d904*=0x56) returned 0x0
	[0173.156] RegCloseKey (hKey=0x404) returned 0x0
	[0173.161] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20
	[0173.167] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20
	[0173.175] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20
	[0173.182] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20
	[0173.188] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20
	[0173.218] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20
	[0173.225] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b
	[0173.225] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x5b, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x5a
	[0173.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d6e8) returned 1
	[0173.225] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x586d9ac | out: lpFileInformation=0x586d9ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0173.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d6e4) returned 1
	[0173.228] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20
	[0173.288] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55
	[0173.288] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54
	[0173.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d210) returned 1
	[0173.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2baf4a0 | out: lpFileInformation=0x2baf4a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1
	[0173.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d20c) returned 1
	[0173.290] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55
	[0173.290] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54
	[0173.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d3b4) returned 1
	[0173.290] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x404
	[0173.290] GetFileType (hFile=0x404) returned 0x1
	[0173.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d3b0) returned 1
	[0173.291] GetFileType (hFile=0x404) returned 0x1
	[0173.291] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x0
	[0173.291] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.298] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x1000
	[0173.298] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.299] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x2000
	[0173.300] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.300] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x3000
	[0173.300] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.301] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x4000
	[0173.301] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.302] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x5000
	[0173.302] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.302] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x6000
	[0173.303] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.303] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x7000
	[0173.303] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.304] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x8000
	[0173.304] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.305] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x9000
	[0173.305] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.305] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0xa000
	[0173.306] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.306] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0xb000
	[0173.306] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.307] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0xc000
	[0173.307] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.307] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0xd000
	[0173.307] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.308] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0xe000
	[0173.308] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.309] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0xf000
	[0173.311] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.312] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x10000
	[0173.312] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.313] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x11000
	[0173.313] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.313] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x12000
	[0173.313] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.314] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x13000
	[0173.314] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.314] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x14000
	[0173.315] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.315] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x15000
	[0173.315] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.316] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x16000
	[0173.316] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.316] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x17000
	[0173.316] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.318] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x18000
	[0173.318] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.318] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x19000
	[0173.318] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.319] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x1a000
	[0173.319] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.319] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x1b000
	[0173.320] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.320] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x1c000
	[0173.320] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.321] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x1d000
	[0173.321] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.322] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x1e000
	[0173.322] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.322] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x1f000
	[0173.322] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.324] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x20000
	[0173.324] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.324] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x21000
	[0173.324] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.325] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x22000
	[0173.325] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.325] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x23000
	[0173.325] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.326] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x24000
	[0173.326] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.326] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x25000
	[0173.327] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.327] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x26000
	[0173.327] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.328] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x27000
	[0173.328] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.329] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x28000
	[0173.329] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.330] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x29000
	[0173.330] ReadFile (in: hFile=0x404, lpBuffer=0x2bb02a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2bb02a4*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.362] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x2a000
	[0173.362] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.362] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x2b000
	[0173.362] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.363] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x2c000
	[0173.363] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.363] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x2d000
	[0173.363] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.364] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x2e000
	[0173.364] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.366] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x2f000
	[0173.366] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.366] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x30000
	[0173.366] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.367] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x31000
	[0173.367] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.367] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x32000
	[0173.367] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.367] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x33000
	[0173.368] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.368] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x34000
	[0173.368] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.368] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x35000
	[0173.368] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.369] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x36000
	[0173.369] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.369] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x37000
	[0173.369] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.370] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x38000
	[0173.370] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.370] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x39000
	[0173.370] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.371] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x3a000
	[0173.371] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.371] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x3b000
	[0173.372] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.372] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x3c000
	[0173.372] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.372] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x3d000
	[0173.372] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.373] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x3e000
	[0173.373] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.373] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x3f000
	[0173.373] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.374] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x40000
	[0173.374] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.374] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x41000
	[0173.374] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.375] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x42000
	[0173.375] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.375] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x43000
	[0173.375] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.376] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x44000
	[0173.376] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.376] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x45000
	[0173.377] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.377] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x46000
	[0173.377] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.377] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x47000
	[0173.378] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.378] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x48000
	[0173.378] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.379] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x49000
	[0173.379] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.379] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x4a000
	[0173.379] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.380] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x4b000
	[0173.380] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.380] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x4c000
	[0173.380] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.381] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x4d000
	[0173.381] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.381] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x4e000
	[0173.382] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.388] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x4f000
	[0173.389] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.389] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x50000
	[0173.389] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.390] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x51000
	[0173.390] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.390] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x52000
	[0173.390] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.391] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x53000
	[0173.391] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.391] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x54000
	[0173.391] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.392] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x55000
	[0173.392] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.392] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x56000
	[0173.393] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.393] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x57000
	[0173.393] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.394] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x58000
	[0173.394] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.394] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x59000
	[0173.394] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.395] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x5a000
	[0173.395] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.395] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x5b000
	[0173.395] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.396] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x5c000
	[0173.396] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.396] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x5d000
	[0173.396] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.397] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x5e000
	[0173.397] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.397] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x5f000
	[0173.398] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.398] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x60000
	[0173.398] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.398] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x61000
	[0173.399] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.399] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x62000
	[0173.399] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.400] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x63000
	[0173.400] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.400] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x64000
	[0173.400] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.401] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x65000
	[0173.401] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.401] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x66000
	[0173.402] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.402] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x67000
	[0173.402] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.403] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x68000
	[0173.403] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.403] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x69000
	[0173.403] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.403] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x6a000
	[0173.404] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.404] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x6b000
	[0173.404] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.404] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x6c000
	[0173.405] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.405] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x6d000
	[0173.405] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.405] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x6e000
	[0173.406] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.406] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x6f000
	[0173.406] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.407] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x70000
	[0173.407] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.407] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x71000
	[0173.407] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.407] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x72000
	[0173.408] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.408] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x73000
	[0173.408] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.408] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x74000
	[0173.409] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.409] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x75000
	[0173.409] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.409] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x76000
	[0173.409] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.410] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x77000
	[0173.410] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.410] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x78000
	[0173.410] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.411] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x79000
	[0173.411] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.411] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x7a000
	[0173.411] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.411] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x7b000
	[0173.412] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.412] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x7c000
	[0173.412] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.412] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x7d000
	[0173.412] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.413] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x7e000
	[0173.413] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.413] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x7f000
	[0173.413] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.414] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x80000
	[0173.414] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.414] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x81000
	[0173.414] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.414] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x82000
	[0173.414] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.415] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x83000
	[0173.415] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.415] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x84000
	[0173.415] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.416] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x85000
	[0173.416] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.416] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x86000
	[0173.416] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.416] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x87000
	[0173.417] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.417] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x88000
	[0173.417] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.417] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x89000
	[0173.417] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.417] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x8a000
	[0173.418] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.418] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x8b000
	[0173.418] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x1000, lpOverlapped=0x0) returned 1
	[0173.418] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x8c000
	[0173.418] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0xaa9, lpOverlapped=0x0) returned 1
	[0173.418] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x8caa9
	[0173.419] ReadFile (in: hFile=0x404, lpBuffer=0x2985775, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x2985775*, lpNumberOfBytesRead=0x586d41c*=0x0, lpOverlapped=0x0) returned 1
	[0173.419] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d3f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d3f0*=0) returned 0x8caa9
	[0173.419] ReadFile (in: hFile=0x404, lpBuffer=0x298592c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d41c, lpOverlapped=0x0 | out: lpBuffer=0x298592c*, lpNumberOfBytesRead=0x586d41c*=0x0, lpOverlapped=0x0) returned 1
	[0173.440] CloseHandle (hObject=0x404) returned 1
	[0174.045] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55
	[0174.045] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54
	[0174.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d174) returned 1
	[0174.045] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x3027b70 | out: lpFileInformation=0x3027b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1
	[0174.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d170) returned 1
	[0174.067] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0174.067] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0174.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586df6c) returned 1
	[0174.067] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x304c0a8 | out: lpFileInformation=0x304c0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0174.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586df68) returned 1
	[0174.088] EtwEventActivityIdControl () returned 0x0
	[0174.093] SetEvent (hEvent=0x3fc) returned 1
	[0174.094] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x586e74c*=0x3fc, lpdwindex=0x586e570 | out: lpdwindex=0x586e570) returned 0x0
	[0174.095] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0174.095] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0174.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e62c) returned 1
	[0174.095] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x304f0b8 | out: lpFileInformation=0x304f0b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0174.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e628) returned 1
	[0174.096] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff
	[0174.096] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff
	[0174.096] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff
	[0174.096] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff
	[0174.097] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff
	[0174.097] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff
	[0174.100] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10
	[0174.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0174.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33
	[0174.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32
	[0174.102] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92e0
	[0174.102] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.102] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1
	[0174.102] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1
	[0174.102] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1
	[0174.102] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1
	[0174.102] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1
	[0174.102] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1
	[0174.103] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1
	[0174.103] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1
	[0174.103] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1
	[0174.103] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1
	[0174.103] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1
	[0174.103] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1
	[0174.103] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1
	[0174.103] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1
	[0174.103] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1
	[0174.103] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0174.103] FindClose (in: hFindFile=0x2e92e0 | out: hFindFile=0x2e92e0) returned 1
	[0174.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0174.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0174.104] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff
	[0174.104] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff
	[0174.104] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff
	[0174.104] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff
	[0174.104] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff
	[0174.104] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff
	[0174.104] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40
	[0174.104] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f
	[0174.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0174.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e
	[0174.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d
	[0174.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37
	[0174.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36
	[0174.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.112] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.112] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50
	[0174.112] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f
	[0174.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.112] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.113] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0174.114] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53
	[0174.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.114] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.114] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d
	[0174.114] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c
	[0174.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.114] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.115] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53
	[0174.115] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52
	[0174.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.115] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.115] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53
	[0174.115] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52
	[0174.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.116] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51
	[0174.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50
	[0174.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.116] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.117] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50
	[0174.118] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f
	[0174.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.118] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.118] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e
	[0174.118] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d
	[0174.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.118] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.119] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f
	[0174.119] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e
	[0174.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.119] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.120] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41
	[0174.120] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40
	[0174.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.120] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.121] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42
	[0174.121] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41
	[0174.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.121] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47
	[0174.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46
	[0174.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e68c) returned 1
	[0174.122] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x586e950 | out: lpFileInformation=0x586e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e688) returned 1
	[0174.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0174.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50
	[0174.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f
	[0174.123] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92e0
	[0174.123] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.123] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1
	[0174.123] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1
	[0174.123] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0
	[0174.124] FindClose (in: hFindFile=0x2e92e0 | out: hFindFile=0x2e92e0) returned 1
	[0174.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0174.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0174.124] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20
	[0174.124] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72
	[0174.125] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71
	[0174.125] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72
	[0174.125] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71
	[0174.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0174.125] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x3057a38 | out: lpFileInformation=0x3057a38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1
	[0174.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0174.125] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72
	[0174.125] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71
	[0174.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0174.125] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c0
	[0174.126] GetFileType (hFile=0x3c0) returned 0x1
	[0174.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0174.126] GetFileType (hFile=0x3c0) returned 0x1
	[0174.126] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0174.126] ReadFile (in: hFile=0x3c0, lpBuffer=0x3058868, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x3058868*, lpNumberOfBytesRead=0x586e884*=0x982, lpOverlapped=0x0) returned 1
	[0174.128] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x982
	[0174.128] ReadFile (in: hFile=0x3c0, lpBuffer=0x3057d7e, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x3057d7e*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0174.129] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x982
	[0174.129] ReadFile (in: hFile=0x3c0, lpBuffer=0x3058868, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x3058868*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0174.129] CloseHandle (hObject=0x3c0) returned 1
	[0174.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0174.130] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53
	[0174.130] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52
	[0174.131] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92e0
	[0174.131] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.131] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1
	[0174.131] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0
	[0174.131] FindClose (in: hFindFile=0x2e92e0 | out: hFindFile=0x2e92e0) returned 1
	[0174.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0174.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0174.131] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20
	[0174.132] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.132] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.132] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.132] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0174.132] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x30691a4 | out: lpFileInformation=0x30691a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1
	[0174.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0174.132] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.133] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0174.133] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c0
	[0174.133] GetFileType (hFile=0x3c0) returned 0x1
	[0174.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0174.133] GetFileType (hFile=0x3c0) returned 0x1
	[0174.133] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0174.133] ReadFile (in: hFile=0x3c0, lpBuffer=0x3069fe4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x3069fe4*, lpNumberOfBytesRead=0x586e884*=0x9e9, lpOverlapped=0x0) returned 1
	[0174.136] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x9e9
	[0174.136] ReadFile (in: hFile=0x3c0, lpBuffer=0x3069561, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x3069561*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0174.136] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x9e9
	[0174.136] ReadFile (in: hFile=0x3c0, lpBuffer=0x3069fe4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x3069fe4*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0174.137] CloseHandle (hObject=0x3c0) returned 1
	[0174.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0174.139] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40
	[0174.139] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f
	[0174.140] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92e0
	[0174.141] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.142] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37af1c1c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0x37af1c1c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0x37af1c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer.Format.ps1xml", cAlternateFileName="")) returned 1
	[0174.142] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a2760e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x14a2760e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37b3dedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer.psd1", cAlternateFileName="")) returned 1
	[0174.142] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1e4bcac7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0174.142] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c83bd9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c83bd9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c83bd9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll", cAlternateFileName="")) returned 1
	[0174.142] FindNextFileW (in: hFindFile=0x2e92e0, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c83bd9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3c83bd9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3c83bd9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll", cAlternateFileName="")) returned 0
	[0174.142] FindClose (in: hFindFile=0x2e92e0 | out: hFindFile=0x2e92e0) returned 1
	[0174.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0174.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0174.144] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20
	[0174.145] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0174.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0174.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0174.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0174.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0174.146] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1"), fInfoLevelId=0x0, lpFileInformation=0x307a734 | out: lpFileInformation=0x307a734*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a2760e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x14a2760e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37b3dedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3b6)) returned 1
	[0174.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0174.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0174.147] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0174.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0174.147] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c0
	[0174.147] GetFileType (hFile=0x3c0) returned 0x1
	[0174.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0174.147] GetFileType (hFile=0x3c0) returned 0x1
	[0174.147] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0174.148] ReadFile (in: hFile=0x3c0, lpBuffer=0x307b524, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x307b524*, lpNumberOfBytesRead=0x586e884*=0x3b6, lpOverlapped=0x0) returned 1
	[0174.151] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x3b6
	[0174.151] ReadFile (in: hFile=0x3c0, lpBuffer=0x307b524, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x307b524*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0174.152] CloseHandle (hObject=0x3c0) returned 1
	[0174.152] CoCreateGuid (in: pguid=0x586e8c4 | out: pguid=0x586e8c4*(Data1=0x83620abe, Data2=0x4d6c, Data3=0x46f0, Data4=([0]=0xa5, [1]=0x6e, [2]=0xdb, [3]=0xe2, [4]=0xa4, [5]=0x97, [6]=0xab, [7]=0x1e))) returned 0x0
	[0174.153] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c0
	[0174.153] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x404
	[0174.154] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x360
	[0174.154] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x408
	[0174.154] SetEvent (hEvent=0x408) returned 1
	[0174.154] SetEvent (hEvent=0x3c0) returned 1
	[0174.154] SetEvent (hEvent=0x404) returned 1
	[0174.155] SetEvent (hEvent=0x360) returned 1
	[0174.155] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x40c
	[0174.156] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0174.157] EtwEventActivityIdControl () returned 0x0
	[0174.157] EtwEventActivityIdControl () returned 0x0
	[0174.157] EtwEventActivityIdControl () returned 0x0
	[0174.166] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20
	[0174.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0174.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0174.167] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586e1fc, Length=0x20, ResultLength=0x586e26c | out: SystemInformation=0x586e1fc, ResultLength=0x586e26c*=0x0) returned 0xc0000003
	[0174.167] GetSystemInfo (in: lpSystemInfo=0x586e278 | out: lpSystemInfo=0x586e278*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0174.168] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586e208 | out: phkResult=0x586e208*=0x410) returned 0x0
	[0174.168] RegQueryValueExW (in: hKey=0x410, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586e224, lpData=0x0, lpcbData=0x586e220*=0x0 | out: lpType=0x586e224*=0x0, lpData=0x0, lpcbData=0x586e220*=0x0) returned 0x2
	[0174.168] RegCloseKey (hKey=0x410) returned 0x0
	[0174.169] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0174.169] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0174.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e180) returned 1
	[0174.169] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x410
	[0174.169] GetFileType (hFile=0x410) returned 0x1
	[0174.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e17c) returned 1
	[0174.170] GetFileType (hFile=0x410) returned 0x1
	[0174.170] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x0
	[0174.170] ReadFile (in: hFile=0x410, lpBuffer=0x3088f1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x3088f1c*, lpNumberOfBytesRead=0x586e1e8*=0x3b6, lpOverlapped=0x0) returned 1
	[0174.170] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x3b6
	[0174.171] ReadFile (in: hFile=0x410, lpBuffer=0x3088f1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x3088f1c*, lpNumberOfBytesRead=0x586e1e8*=0x0, lpOverlapped=0x0) returned 1
	[0174.171] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586e150, Length=0x20, ResultLength=0x586e1c0 | out: SystemInformation=0x586e150, ResultLength=0x586e1c0*=0x0) returned 0xc0000003
	[0174.171] GetSystemInfo (in: lpSystemInfo=0x586e1cc | out: lpSystemInfo=0x586e1cc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0174.172] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586e15c | out: phkResult=0x586e15c*=0x414) returned 0x0
	[0174.172] RegQueryValueExW (in: hKey=0x414, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586e178, lpData=0x0, lpcbData=0x586e174*=0x0 | out: lpType=0x586e178*=0x0, lpData=0x0, lpcbData=0x586e174*=0x0) returned 0x2
	[0174.172] RegCloseKey (hKey=0x414) returned 0x0
	[0174.172] CloseHandle (hObject=0x410) returned 1
	[0174.173] CoCreateGuid (in: pguid=0x586e24c | out: pguid=0x586e24c*(Data1=0x98c3e04d, Data2=0x7cf, Data3=0x4cb4, Data4=([0]=0xa0, [1]=0x4b, [2]=0xcc, [3]=0x6c, [4]=0xf8, [5]=0x65, [6]=0x37, [7]=0x53))) returned 0x0
	[0174.175] QueryPerformanceCounter (in: lpPerformanceCount=0x586dfac | out: lpPerformanceCount=0x586dfac*=2531838773489) returned 1
	[0174.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0174.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0174.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586dc98) returned 1
	[0174.176] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586df5c | out: lpFileInformation=0x586df5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a2760e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x14a2760e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37b3dedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3b6)) returned 1
	[0174.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dc94) returned 1
	[0174.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0174.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0174.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0174.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0174.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586dc2c) returned 1
	[0174.177] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586def0 | out: lpFileInformation=0x586def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a2760e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x14a2760e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37b3dedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3b6)) returned 1
	[0174.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dc28) returned 1
	[0174.177] CoTaskMemAlloc (cb=0x10) returned 0x349a88
	[0174.177] CoTaskMemAlloc (cb=0x10) returned 0x349ba8
	[0174.177] CoTaskMemAlloc (cb=0xa4) returned 0x3389b0
	[0174.177] CoTaskMemAlloc (cb=0x30) returned 0x3354f0
	[0174.177] WinVerifyTrust () returned 0x800b0100
	[0174.220] CoTaskMemFree (pv=0x349a88) 
	[0174.220] CoTaskMemFree (pv=0x3354f0) 
	[0174.220] CryptCATHandleFromStore () returned 0x2d5830
	[0174.220] WTHelperGetProvSignerFromChain () returned 0x0
	[0174.220] CoTaskMemAlloc (cb=0x10) returned 0x349a88
	[0174.220] CoTaskMemAlloc (cb=0x30) returned 0x3354f0
	[0174.220] WinVerifyTrust () returned 0x0
	[0174.221] CoTaskMemFree (pv=0x3354f0) 
	[0174.221] CoTaskMemFree (pv=0x349a88) 
	[0174.221] CoTaskMemFree (pv=0x3389b0) 
	[0174.221] CoTaskMemFree (pv=0x349ba8) 
	[0174.284] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x586da50, nSize=0xc6 | out: lpBuffer="") returned 0x0
	[0174.284] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x586d96c, nSize=0xc6 | out: lpBuffer="") returned 0xbd
	[0174.285] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x586d958, nSize=0xc6 | out: lpBuffer="") returned 0x3a
	[0174.286] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x358ee8 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a
	[0174.287] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x586d960, nSize=0xc6 | out: lpBuffer="") returned 0x3a
	[0174.287] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49
	[0174.287] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48
	[0174.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d864) returned 1
	[0174.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x586db28 | out: lpFileInformation=0x586db28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d860) returned 1
	[0174.288] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14
	[0174.288] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0174.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d864) returned 1
	[0174.288] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x586db28 | out: lpFileInformation=0x586db28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0174.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d860) returned 1
	[0174.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db20) returned 1
	[0174.288] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14
	[0174.288] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0174.289] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Join-Path.*", lpFindFileData=0x586d8d0 | out: lpFindFileData=0x586d8d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0174.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d878) returned 1
	[0174.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dad8) returned 1
	[0174.289] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb
	[0174.289] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
	[0174.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d864) returned 1
	[0174.289] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x586db28 | out: lpFileInformation=0x586db28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0174.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d860) returned 1
	[0174.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db20) returned 1
	[0174.290] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb
	[0174.290] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
	[0174.290] FindFirstFileW (in: lpFileName="C:\\Windows\\Join-Path.*", lpFindFileData=0x586d8d0 | out: lpFindFileData=0x586d8d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0174.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d878) returned 1
	[0174.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dad8) returned 1
	[0174.290] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19
	[0174.290] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18
	[0174.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d864) returned 1
	[0174.291] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x586db28 | out: lpFileInformation=0x586db28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1
	[0174.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d860) returned 1
	[0174.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db20) returned 1
	[0174.291] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19
	[0174.291] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18
	[0174.291] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Join-Path.*", lpFindFileData=0x586d8d0 | out: lpFindFileData=0x586d8d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0174.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d878) returned 1
	[0174.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dad8) returned 1
	[0174.292] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c
	[0174.292] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b
	[0174.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d864) returned 1
	[0174.292] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x586db28 | out: lpFileInformation=0x586db28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0174.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d860) returned 1
	[0174.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db20) returned 1
	[0174.292] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c
	[0174.292] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b
	[0174.292] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Join-Path.*", lpFindFileData=0x586d8d0 | out: lpFindFileData=0x586d8d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0174.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d878) returned 1
	[0174.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dad8) returned 1
	[0174.293] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x586d9c4, nSize=0xc6 | out: lpBuffer="") returned 0xc5
	[0174.296] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10
	[0174.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db50) returned 1
	[0174.297] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b
	[0174.297] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a
	[0174.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x586d900 | out: lpFindFileData=0x586d900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0174.298] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.298] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1
	[0174.298] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1
	[0174.298] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0174.298] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0174.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c0) returned 1
	[0174.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586db20) returned 1
	[0174.299] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff
	[0174.299] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff
	[0174.299] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff
	[0174.299] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff
	[0174.299] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff
	[0174.299] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff
	[0174.300] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d
	[0174.300] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c
	[0174.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.300] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.300] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39
	[0174.300] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38
	[0174.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.300] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db50) returned 1
	[0174.301] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d
	[0174.301] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c
	[0174.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x586d900 | out: lpFindFileData=0x586d900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0174.302] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.302] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0174.302] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0174.302] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0174.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c0) returned 1
	[0174.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586db20) returned 1
	[0174.302] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c
	[0174.302] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b
	[0174.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a4) returned 1
	[0174.303] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586db68 | out: lpFileInformation=0x586db68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1
	[0174.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8a0) returned 1
	[0174.303] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c
	[0174.303] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b
	[0174.303] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c
	[0174.303] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b
	[0174.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8c8) returned 1
	[0174.303] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x30a2900 | out: lpFileInformation=0x30a2900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1
	[0174.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c4) returned 1
	[0174.304] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff
	[0174.304] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff
	[0174.304] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff
	[0174.304] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff
	[0174.304] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff
	[0174.304] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff
	[0174.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db50) returned 1
	[0174.305] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39
	[0174.305] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38
	[0174.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x586d900 | out: lpFindFileData=0x586d900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0174.305] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.305] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0174.306] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0174.306] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0174.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c0) returned 1
	[0174.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586db20) returned 1
	[0174.306] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0174.306] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53
	[0174.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a4) returned 1
	[0174.306] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586db68 | out: lpFileInformation=0x586db68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0174.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8a0) returned 1
	[0174.306] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0174.306] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53
	[0174.307] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0174.307] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53
	[0174.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8c8) returned 1
	[0174.307] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x30a3e64 | out: lpFileInformation=0x30a3e64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0174.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c4) returned 1
	[0174.307] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff
	[0174.307] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff
	[0174.307] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff
	[0174.308] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff
	[0174.308] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff
	[0174.308] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff
	[0174.312] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff
	[0174.322] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10
	[0174.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db50) returned 1
	[0174.324] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31
	[0174.324] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30
	[0174.324] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x586d900 | out: lpFindFileData=0x586d900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0174.325] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.325] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1
	[0174.325] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1
	[0174.325] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0174.325] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0174.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c0) returned 1
	[0174.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586db20) returned 1
	[0174.325] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff
	[0174.326] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff
	[0174.326] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff
	[0174.326] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff
	[0174.326] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff
	[0174.326] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff
	[0174.326] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43
	[0174.326] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42
	[0174.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.326] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.327] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f
	[0174.327] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e
	[0174.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.327] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db50) returned 1
	[0174.327] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43
	[0174.328] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42
	[0174.328] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x586d900 | out: lpFindFileData=0x586d900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0174.328] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.328] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0174.328] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0174.328] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0174.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c0) returned 1
	[0174.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586db20) returned 1
	[0174.329] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62
	[0174.329] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61
	[0174.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a4) returned 1
	[0174.329] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586db68 | out: lpFileInformation=0x586db68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1
	[0174.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8a0) returned 1
	[0174.329] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62
	[0174.329] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61
	[0174.329] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62
	[0174.329] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61
	[0174.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8c8) returned 1
	[0174.330] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x30adc48 | out: lpFileInformation=0x30adc48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1
	[0174.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c4) returned 1
	[0174.330] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff
	[0174.330] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff
	[0174.331] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff
	[0174.331] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff
	[0174.331] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff
	[0174.331] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff
	[0174.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db50) returned 1
	[0174.331] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f
	[0174.331] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e
	[0174.331] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x586d900 | out: lpFindFileData=0x586d900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0174.332] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.332] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1
	[0174.332] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0174.332] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0174.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c0) returned 1
	[0174.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586db20) returned 1
	[0174.332] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0174.332] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0174.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a4) returned 1
	[0174.332] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586db68 | out: lpFileInformation=0x586db68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0174.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8a0) returned 1
	[0174.333] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0174.333] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0174.333] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0174.333] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59
	[0174.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8c8) returned 1
	[0174.333] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x30af318 | out: lpFileInformation=0x30af318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1
	[0174.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c4) returned 1
	[0174.333] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff
	[0174.333] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff
	[0174.334] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff
	[0174.334] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff
	[0174.334] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff
	[0174.334] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff
	[0174.338] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10
	[0174.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db50) returned 1
	[0174.339] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33
	[0174.339] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32
	[0174.340] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x586d900 | out: lpFindFileData=0x586d900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0174.340] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.340] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1
	[0174.340] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1
	[0174.340] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1
	[0174.340] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1
	[0174.340] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1
	[0174.340] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1
	[0174.340] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1
	[0174.341] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1
	[0174.341] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1
	[0174.341] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1
	[0174.341] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1
	[0174.341] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1
	[0174.341] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1
	[0174.341] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1
	[0174.341] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1
	[0174.341] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0174.341] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0174.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c0) returned 1
	[0174.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586db20) returned 1
	[0174.342] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff
	[0174.342] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff
	[0174.342] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff
	[0174.342] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff
	[0174.342] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff
	[0174.342] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff
	[0174.342] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40
	[0174.342] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f
	[0174.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.343] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0174.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.343] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e
	[0174.343] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d
	[0174.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.343] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.343] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37
	[0174.343] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36
	[0174.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.344] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.344] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50
	[0174.344] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f
	[0174.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.344] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.344] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0174.345] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53
	[0174.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.345] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.345] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d
	[0174.345] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c
	[0174.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.345] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.346] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53
	[0174.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52
	[0174.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.347] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53
	[0174.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52
	[0174.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.347] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51
	[0174.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50
	[0174.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.348] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50
	[0174.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f
	[0174.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.349] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.349] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e
	[0174.349] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d
	[0174.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.349] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.349] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f
	[0174.349] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e
	[0174.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.350] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41
	[0174.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40
	[0174.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.350] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42
	[0174.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41
	[0174.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.351] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47
	[0174.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46
	[0174.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8a0) returned 1
	[0174.351] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x586db64 | out: lpFileInformation=0x586db64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0174.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d89c) returned 1
	[0174.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db50) returned 1
	[0174.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50
	[0174.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f
	[0174.352] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x586d900 | out: lpFindFileData=0x586d900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0174.353] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.353] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1
	[0174.353] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1
	[0174.353] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0
	[0174.353] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0174.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c0) returned 1
	[0174.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586db20) returned 1
	[0174.353] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20
	[0174.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72
	[0174.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71
	[0174.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72
	[0174.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71
	[0174.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8c8) returned 1
	[0174.354] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x30b7e5c | out: lpFileInformation=0x30b7e5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1
	[0174.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c4) returned 1
	[0174.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586db50) returned 1
	[0174.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53
	[0174.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52
	[0174.355] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x586d900 | out: lpFindFileData=0x586d900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e92a0
	[0174.355] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.355] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1
	[0174.355] FindNextFileW (in: hFindFile=0x2e92a0, lpFindFileData=0x586d908 | out: lpFindFileData=0x586d908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0
	[0174.355] FindClose (in: hFindFile=0x2e92a0 | out: hFindFile=0x2e92a0) returned 1
	[0174.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c0) returned 1
	[0174.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586db20) returned 1
	[0174.356] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20
	[0174.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d8c8) returned 1
	[0174.356] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x30b862c | out: lpFileInformation=0x30b862c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1
	[0174.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d8c4) returned 1
	[0174.357] CoCreateGuid (in: pguid=0x586db98 | out: pguid=0x586db98*(Data1=0x3bc13675, Data2=0x7ed5, Data3=0x4e31, Data4=([0]=0xb2, [1]=0xa5, [2]=0x3a, [3]=0xb5, [4]=0x66, [5]=0x25, [6]=0x28, [7]=0xec))) returned 0x0
	[0174.357] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x414
	[0174.357] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x418
	[0174.358] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x41c
	[0174.358] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x420
	[0174.358] SetEvent (hEvent=0x420) returned 1
	[0174.358] SetEvent (hEvent=0x414) returned 1
	[0174.358] SetEvent (hEvent=0x418) returned 1
	[0174.358] SetEvent (hEvent=0x41c) returned 1
	[0174.359] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x424
	[0174.359] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0174.430] EtwEventActivityIdControl () returned 0x0
	[0174.430] EtwEventActivityIdControl () returned 0x0
	[0174.430] EtwEventActivityIdControl () returned 0x0
	[0174.447] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20
	[0174.448] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.448] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d3c4) returned 1
	[0174.448] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586d688 | out: lpFileInformation=0x586d688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1
	[0174.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d3c0) returned 1
	[0174.449] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20
	[0174.449] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.449] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.449] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586d2cc, Length=0x20, ResultLength=0x586d33c | out: SystemInformation=0x586d2cc, ResultLength=0x586d33c*=0x0) returned 0xc0000003
	[0174.449] GetSystemInfo (in: lpSystemInfo=0x586d348 | out: lpSystemInfo=0x586d348*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0174.450] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d2d8 | out: phkResult=0x586d2d8*=0x428) returned 0x0
	[0174.450] RegQueryValueExW (in: hKey=0x428, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586d2f4, lpData=0x0, lpcbData=0x586d2f0*=0x0 | out: lpType=0x586d2f4*=0x0, lpData=0x0, lpcbData=0x586d2f0*=0x0) returned 0x2
	[0174.450] RegCloseKey (hKey=0x428) returned 0x0
	[0174.450] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.450] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d250) returned 1
	[0174.451] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x428
	[0174.451] GetFileType (hFile=0x428) returned 0x1
	[0174.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d24c) returned 1
	[0174.451] GetFileType (hFile=0x428) returned 0x1
	[0174.451] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d28c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d28c*=0) returned 0x0
	[0174.451] ReadFile (in: hFile=0x428, lpBuffer=0x30dd168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d2b8, lpOverlapped=0x0 | out: lpBuffer=0x30dd168*, lpNumberOfBytesRead=0x586d2b8*=0x9e9, lpOverlapped=0x0) returned 1
	[0174.452] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d28c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d28c*=0) returned 0x9e9
	[0174.452] ReadFile (in: hFile=0x428, lpBuffer=0x30dc6f1, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x586d2b8, lpOverlapped=0x0 | out: lpBuffer=0x30dc6f1*, lpNumberOfBytesRead=0x586d2b8*=0x0, lpOverlapped=0x0) returned 1
	[0174.452] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d28c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d28c*=0) returned 0x9e9
	[0174.452] ReadFile (in: hFile=0x428, lpBuffer=0x30dd168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d2b8, lpOverlapped=0x0 | out: lpBuffer=0x30dd168*, lpNumberOfBytesRead=0x586d2b8*=0x0, lpOverlapped=0x0) returned 1
	[0174.452] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586d220, Length=0x20, ResultLength=0x586d290 | out: SystemInformation=0x586d220, ResultLength=0x586d290*=0x0) returned 0xc0000003
	[0174.453] GetSystemInfo (in: lpSystemInfo=0x586d29c | out: lpSystemInfo=0x586d29c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0174.453] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d22c | out: phkResult=0x586d22c*=0x42c) returned 0x0
	[0174.453] RegQueryValueExW (in: hKey=0x42c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586d248, lpData=0x0, lpcbData=0x586d244*=0x0 | out: lpType=0x586d248*=0x0, lpData=0x0, lpcbData=0x586d244*=0x0) returned 0x2
	[0174.453] RegCloseKey (hKey=0x42c) returned 0x0
	[0174.453] CloseHandle (hObject=0x428) returned 1
	[0174.455] CoCreateGuid (in: pguid=0x586d31c | out: pguid=0x586d31c*(Data1=0xb15c4582, Data2=0xbf09, Data3=0x497c, Data4=([0]=0xaa, [1]=0xf1, [2]=0xf3, [3]=0xe, [4]=0xa9, [5]=0x31, [6]=0x6, [7]=0xfe))) returned 0x0
	[0174.455] QueryPerformanceCounter (in: lpPerformanceCount=0x586d07c | out: lpPerformanceCount=0x586d07c*=2531866716029) returned 1
	[0174.455] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.455] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586cd68) returned 1
	[0174.455] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586d02c | out: lpFileInformation=0x586d02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1
	[0174.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586cd64) returned 1
	[0174.455] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.456] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.456] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.456] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586ccfc) returned 1
	[0174.456] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586cfc0 | out: lpFileInformation=0x586cfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1
	[0174.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586ccf8) returned 1
	[0174.456] CoTaskMemAlloc (cb=0x10) returned 0x349a88
	[0174.456] CoTaskMemAlloc (cb=0x10) returned 0x349ae8
	[0174.456] CoTaskMemAlloc (cb=0xf0) returned 0x3389b0
	[0174.456] CoTaskMemAlloc (cb=0x30) returned 0x3354f0
	[0174.456] WinVerifyTrust () returned 0x800b0100
	[0174.470] CoTaskMemFree (pv=0x349a88) 
	[0174.470] CoTaskMemFree (pv=0x3354f0) 
	[0174.471] CryptCATHandleFromStore () returned 0x2d5830
	[0174.471] WTHelperGetProvSignerFromChain () returned 0x0
	[0174.471] CoTaskMemAlloc (cb=0x10) returned 0x349a88
	[0174.471] CoTaskMemAlloc (cb=0x30) returned 0x3354f0
	[0174.471] WinVerifyTrust () returned 0x0
	[0174.471] CoTaskMemFree (pv=0x3354f0) 
	[0174.471] CoTaskMemFree (pv=0x349a88) 
	[0174.471] CoTaskMemFree (pv=0x3389b0) 
	[0174.471] CoTaskMemFree (pv=0x349ae8) 
	[0174.474] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff
	[0174.474] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff
	[0174.475] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0174.475] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77
	[0174.475] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53
	[0174.475] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52
	[0174.494] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67
	[0174.495] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66
	[0174.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586c7b8) returned 1
	[0174.495] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x586ca7c | out: lpFileInformation=0x586ca7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586c7b4) returned 1
	[0174.495] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff
	[0174.495] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff
	[0174.495] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x586c734, nSize=0xc6 | out: lpBuffer="") returned 0xc5
	[0174.499] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10
	[0174.500] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0174.501] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53
	[0174.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586c5c0) returned 1
	[0174.501] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x586c884 | out: lpFileInformation=0x586c884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586c5bc) returned 1
	[0174.506] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff
	[0174.510] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff
	[0174.517] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10
	[0174.518] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a
	[0174.518] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59
	[0174.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586c5c0) returned 1
	[0174.518] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x586c884 | out: lpFileInformation=0x586c884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586c5bc) returned 1
	[0174.523] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff
	[0174.526] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10
	[0174.527] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c
	[0174.527] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b
	[0174.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586c5c0) returned 1
	[0174.527] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x586c884 | out: lpFileInformation=0x586c884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586c5bc) returned 1
	[0174.532] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff
	[0174.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0
	[0174.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f
	[0174.896] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0
	[0174.896] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f
	[0174.896] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0
	[0174.896] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f
	[0175.654] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d654 | out: phkResult=0x586d654*=0x3f0) returned 0x0
	[0175.655] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d674, lpData=0x0, lpcbData=0x586d670*=0x0 | out: lpType=0x586d674*=0x1, lpData=0x0, lpcbData=0x586d670*=0x56) returned 0x0
	[0175.655] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d674, lpData=0x2acd00c, lpcbData=0x586d670*=0x56 | out: lpType=0x586d674*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x586d670*=0x56) returned 0x0
	[0175.655] RegCloseKey (hKey=0x3f0) returned 0x0
	[0175.656] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d654 | out: phkResult=0x586d654*=0x3f0) returned 0x0
	[0175.656] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d674, lpData=0x0, lpcbData=0x586d670*=0x0 | out: lpType=0x586d674*=0x1, lpData=0x0, lpcbData=0x586d670*=0x56) returned 0x0
	[0175.657] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d674, lpData=0x2acd320, lpcbData=0x586d670*=0x56 | out: lpType=0x586d674*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x586d670*=0x56) returned 0x0
	[0175.657] RegCloseKey (hKey=0x3f0) returned 0x0
	[0175.657] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d654 | out: phkResult=0x586d654*=0x3f0) returned 0x0
	[0175.657] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d674, lpData=0x0, lpcbData=0x586d670*=0x0 | out: lpType=0x586d674*=0x1, lpData=0x0, lpcbData=0x586d670*=0x56) returned 0x0
	[0175.657] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d674, lpData=0x2acd628, lpcbData=0x586d670*=0x56 | out: lpType=0x586d674*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x586d670*=0x56) returned 0x0
	[0175.657] RegCloseKey (hKey=0x3f0) returned 0x0
	[0175.658] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d654 | out: phkResult=0x586d654*=0x3f0) returned 0x0
	[0175.658] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d674, lpData=0x0, lpcbData=0x586d670*=0x0 | out: lpType=0x586d674*=0x1, lpData=0x0, lpcbData=0x586d670*=0x56) returned 0x0
	[0175.658] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d674, lpData=0x2acd93c, lpcbData=0x586d670*=0x56 | out: lpType=0x586d674*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x586d670*=0x56) returned 0x0
	[0175.658] RegCloseKey (hKey=0x3f0) returned 0x0
	[0175.659] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d6a0 | out: phkResult=0x586d6a0*=0x3f0) returned 0x0
	[0175.660] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d6c0, lpData=0x0, lpcbData=0x586d6bc*=0x0 | out: lpType=0x586d6c0*=0x1, lpData=0x0, lpcbData=0x586d6bc*=0x56) returned 0x0
	[0175.660] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d6c0, lpData=0x2acdc84, lpcbData=0x586d6bc*=0x56 | out: lpType=0x586d6c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x586d6bc*=0x56) returned 0x0
	[0175.660] RegCloseKey (hKey=0x3f0) returned 0x0
	[0175.660] CoTaskMemAlloc (cb=0x20c) returned 0x5b56ca8
	[0175.660] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x5b56ca8 | out: pszPath="C:\\Program Files (x86)") returned 0x0
	[0175.661] CoTaskMemFree (pv=0x5b56ca8) 
	[0175.661] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17
	[0175.661] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16
	[0175.858] EtwEventActivityIdControl () returned 0x0
	[0175.860] SetEvent (hEvent=0x424) returned 1
	[0175.860] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x586d9fc*=0x424, lpdwindex=0x586d820 | out: lpdwindex=0x586d820) returned 0x0
	[0175.863] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x586d990, nSize=0xc6 | out: lpBuffer="") returned 0x0
	[0175.867] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0175.867] GetFileType (hFile=0xb) returned 0x2
	[0175.868] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x586db34 | out: lpMode=0x586db34) returned 1
	[0175.870] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586daf4 | out: lpConsoleScreenBufferInfo=0x586daf4) returned 1
	[0175.871] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586daf4 | out: lpConsoleScreenBufferInfo=0x586daf4) returned 1
	[0175.987] EtwEventActivityIdControl () returned 0x0
	[0175.987] EtwEventActivityIdControl () returned 0x0
	[0175.987] EtwEventActivityIdControl () returned 0x0
	[0176.068] EtwEventActivityIdControl () returned 0x0
	[0176.069] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\en-US\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\en-us\\bitstransfer.psd1")) returned 0xffffffff
	[0176.070] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\en\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\en\\bitstransfer.psd1")) returned 0xffffffff
	[0176.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0176.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0176.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40
	[0176.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f
	[0176.073] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d8e8 | out: phkResult=0x586d8e8*=0x3f0) returned 0x0
	[0176.074] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d908, lpData=0x0, lpcbData=0x586d904*=0x0 | out: lpType=0x586d908*=0x1, lpData=0x0, lpcbData=0x586d904*=0x56) returned 0x0
	[0176.074] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d908, lpData=0x2aeaf98, lpcbData=0x586d904*=0x56 | out: lpType=0x586d908*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x586d904*=0x56) returned 0x0
	[0176.074] RegCloseKey (hKey=0x3f0) returned 0x0
	[0176.081] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.format.ps1xml")) returned 0x20
	[0176.090] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.format.ps1xml")) returned 0x20
	[0176.092] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.format.ps1xml")) returned 0x20
	[0176.099] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0176.099] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\PSGetModuleInfo.xml", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x53
	[0176.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d6e8) returned 1
	[0176.100] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x586d9ac | out: lpFileInformation=0x586d9ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d6e4) returned 1
	[0176.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x73
	[0176.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management", nBufferLength=0x73, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management", lpFilePart=0x0) returned 0x72
	[0176.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d5e8) returned 1
	[0176.101] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management"), fInfoLevelId=0x0, lpFileInformation=0x586d8ac | out: lpFileInformation=0x586d8ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d5e4) returned 1
	[0176.110] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management.psd1")) returned 0xffffffff
	[0176.115] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management.psm1")) returned 0xffffffff
	[0176.120] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management.cdxml")) returned 0xffffffff
	[0176.125] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management.xaml")) returned 0xffffffff
	[0176.130] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management.ni.dll")) returned 0xffffffff
	[0176.135] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management.dll")) returned 0xffffffff
	[0176.141] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.psd1")) returned 0xffffffff
	[0176.147] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.psm1")) returned 0xffffffff
	[0176.154] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.cdxml")) returned 0xffffffff
	[0176.161] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.xaml")) returned 0xffffffff
	[0176.168] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.ni.dll")) returned 0xffffffff
	[0176.174] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.dll")) returned 0xffffffff
	[0176.174] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x586d664, nSize=0xc6 | out: lpBuffer="") returned 0xc5
	[0176.180] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10
	[0176.181] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5e
	[0176.182] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management", nBufferLength=0x5e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management", lpFilePart=0x0) returned 0x5d
	[0176.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d4f0) returned 1
	[0176.182] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management"), fInfoLevelId=0x0, lpFileInformation=0x586d7b4 | out: lpFileInformation=0x586d7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d4ec) returned 1
	[0176.210] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.psd1")) returned 0xffffffff
	[0176.218] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.psm1")) returned 0xffffffff
	[0176.225] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.cdxml")) returned 0xffffffff
	[0176.233] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.xaml")) returned 0xffffffff
	[0176.241] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.ni.dll")) returned 0xffffffff
	[0176.247] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.dll")) returned 0xffffffff
	[0176.253] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff
	[0176.269] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10
	[0176.270] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64
	[0176.270] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management", nBufferLength=0x64, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management", lpFilePart=0x0) returned 0x63
	[0176.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d4f0) returned 1
	[0176.271] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management"), fInfoLevelId=0x0, lpFileInformation=0x586d7b4 | out: lpFileInformation=0x586d7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d4ec) returned 1
	[0176.277] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.psd1")) returned 0xffffffff
	[0176.283] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.psm1")) returned 0xffffffff
	[0176.289] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.cdxml")) returned 0xffffffff
	[0176.296] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.xaml")) returned 0xffffffff
	[0176.302] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.ni.dll")) returned 0xffffffff
	[0176.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.dll")) returned 0xffffffff
	[0176.312] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10
	[0176.313] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66
	[0176.313] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management", nBufferLength=0x66, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management", lpFilePart=0x0) returned 0x65
	[0176.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d4f0) returned 1
	[0176.313] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.backgroundintelligenttransfer.management"), fInfoLevelId=0x0, lpFileInformation=0x586d7b4 | out: lpFileInformation=0x586d7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d4ec) returned 1
	[0176.318] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.psd1")) returned 0xffffffff
	[0176.323] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.psm1")) returned 0xffffffff
	[0176.329] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.cdxml")) returned 0xffffffff
	[0176.334] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.xaml")) returned 0xffffffff
	[0176.339] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.ni.dll")) returned 0xffffffff
	[0176.345] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.BackgroundIntelligentTransfer.Management\\Microsoft.BackgroundIntelligentTransfer.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.backgroundintelligenttransfer.management\\microsoft.backgroundintelligenttransfer.management.dll")) returned 0xffffffff
	[0176.398] CoCreateGuid (in: pguid=0x586d30c | out: pguid=0x586d30c*(Data1=0x4d4a8c66, Data2=0x9c85, Data3=0x4adf, Data4=([0]=0x95, [1]=0x9d, [2]=0xdb, [3]=0xb7, [4]=0xd, [5]=0x58, [6]=0x2a, [7]=0xd9))) returned 0x0
	[0176.403] CoCreateGuid (in: pguid=0x586c99c | out: pguid=0x586c99c*(Data1=0x6a6d1714, Data2=0x1cd, Data3=0x4bab, Data4=([0]=0x97, [1]=0xb6, [2]=0x6e, [3]=0x55, [4]=0x95, [5]=0xce, [6]=0xe3, [7]=0x49))) returned 0x0
	[0176.429] CoCreateGuid (in: pguid=0x586cc54 | out: pguid=0x586cc54*(Data1=0xe448f75e, Data2=0x80f7, Data3=0x4b3c, Data4=([0]=0x96, [1]=0x46, [2]=0xfa, [3]=0x3e, [4]=0x73, [5]=0x72, [6]=0xcf, [7]=0x6c))) returned 0x0
	[0176.456] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x586cce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b
	[0177.867] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x586b5c8 | out: phkResult=0x586b5c8*=0x0) returned 0x2
	[0177.867] RegCloseKey (hKey=0x80000002) returned 0x0
	[0177.873] EtwEventRegister () returned 0x0
	[0177.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x586accc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40
	[0177.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586af14) returned 1
	[0177.877] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x586b1d8 | out: lpFileInformation=0x586b1d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0177.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586af10) returned 1
	[0178.020] CoCreateGuid (in: pguid=0x586b3fc | out: pguid=0x586b3fc*(Data1=0x64aa0c03, Data2=0xaa0f, Data3=0x4dc2, Data4=([0]=0xb4, [1]=0x2e, [2]=0xee, [3]=0x72, [4]=0xd, [5]=0xa9, [6]=0x87, [7]=0xa2))) returned 0x0
	[0178.023] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0xabda8e50, Data2=0x95ec, Data3=0x458e, Data4=([0]=0x97, [1]=0x4, [2]=0xc3, [3]=0xa4, [4]=0x58, [5]=0xbe, [6]=0x9c, [7]=0x8e))) returned 0x0
	[0178.023] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0x9b5e4461, Data2=0xc4f3, Data3=0x4d40, Data4=([0]=0x93, [1]=0xa9, [2]=0xfe, [3]=0x78, [4]=0x9, [5]=0xdc, [6]=0xd4, [7]=0x96))) returned 0x0
	[0178.023] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0x8e47c2c3, Data2=0xaf6e, Data3=0x4c0d, Data4=([0]=0x8b, [1]=0x52, [2]=0xd8, [3]=0xa6, [4]=0xab, [5]=0xaf, [6]=0x99, [7]=0x13))) returned 0x0
	[0178.023] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0x3f64353c, Data2=0x7409, Data3=0x48f9, Data4=([0]=0xbb, [1]=0xbc, [2]=0xf5, [3]=0xe2, [4]=0x60, [5]=0x12, [6]=0x35, [7]=0xc))) returned 0x0
	[0178.023] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0xe8e4388d, Data2=0x5bae, Data3=0x46f0, Data4=([0]=0xaa, [1]=0x20, [2]=0xbd, [3]=0x68, [4]=0xb6, [5]=0xae, [6]=0xf4, [7]=0x35))) returned 0x0
	[0178.023] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0xee77cd22, Data2=0x8698, Data3=0x42d9, Data4=([0]=0xab, [1]=0xc3, [2]=0xde, [3]=0x51, [4]=0x2d, [5]=0x9c, [6]=0xdb, [7]=0xc))) returned 0x0
	[0178.023] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0xdddd79d5, Data2=0xd0d5, Data3=0x4d7b, Data4=([0]=0x8a, [1]=0xbf, [2]=0xb5, [3]=0x8f, [4]=0x7, [5]=0x30, [6]=0x59, [7]=0xa4))) returned 0x0
	[0178.023] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0xdfe3a5bf, Data2=0x392a, Data3=0x4320, Data4=([0]=0x8f, [1]=0xa7, [2]=0x3f, [3]=0x72, [4]=0x44, [5]=0x2c, [6]=0x3c, [7]=0x6))) returned 0x0
	[0178.024] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0x889ccc3b, Data2=0x33fb, Data3=0x41de, Data4=([0]=0x97, [1]=0xe7, [2]=0x88, [3]=0x8c, [4]=0x3d, [5]=0xaa, [6]=0xc6, [7]=0x51))) returned 0x0
	[0178.024] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0xc204ad4c, Data2=0x7e0f, Data3=0x4e40, Data4=([0]=0xb1, [1]=0xd6, [2]=0xd0, [3]=0xb7, [4]=0x4, [5]=0x16, [6]=0x26, [7]=0x68))) returned 0x0
	[0178.024] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0xb41e19a6, Data2=0x4fcf, Data3=0x4438, Data4=([0]=0x95, [1]=0x75, [2]=0xab, [3]=0x8c, [4]=0x0, [5]=0xdb, [6]=0xc, [7]=0xe))) returned 0x0
	[0178.024] CoCreateGuid (in: pguid=0x586b3f0 | out: pguid=0x586b3f0*(Data1=0x87c53a40, Data2=0x4e1b, Data3=0x4989, Data4=([0]=0x8f, [1]=0x8f, [2]=0xdb, [3]=0x81, [4]=0xeb, [5]=0x32, [6]=0xc2, [7]=0xc5))) returned 0x0
	[0178.032] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x586b10c, nSize=0xfa | out: lpBuffer="") returned 0x0
	[0178.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management", nBufferLength=0x105, lpBuffer=0x586b800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management", lpFilePart=0x0) returned 0x72
	[0178.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management", nBufferLength=0x105, lpBuffer=0x586b788, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\Microsoft.BackgroundIntelligentTransfer.Management", lpFilePart=0x0) returned 0x72
	[0178.365] CoGetContextToken (in: pToken=0x586af94 | out: pToken=0x586af94) returned 0x0
	[0178.365] CObjectContext::QueryInterface () returned 0x0
	[0178.365] CObjectContext::GetCurrentApartmentType () returned 0x0
	[0178.365] Release () returned 0x0
	[0178.367] CoGetObjectContext (in: riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b72564 | out: ppv=0x5b72564*=0x2b0c60) returned 0x0
	[0178.367] CoGetContextToken (in: pToken=0x586b3a4 | out: pToken=0x586b3a4) returned 0x0
	[0178.367] CoGetContextToken (in: pToken=0x586b974 | out: pToken=0x586b974) returned 0x0
	[0178.367] CoGetContextToken (in: pToken=0x586b8d4 | out: pToken=0x586b8d4) returned 0x0
	[0178.369] CoGetContextToken (in: pToken=0x586ba04 | out: pToken=0x586ba04) returned 0x0
	[0178.389] CoGetContextToken (in: pToken=0x586af8c | out: pToken=0x586af8c) returned 0x0
	[0178.389] CoGetContextToken (in: pToken=0x586b39c | out: pToken=0x586b39c) returned 0x0
	[0178.389] CoGetContextToken (in: pToken=0x586b96c | out: pToken=0x586b96c) returned 0x0
	[0178.390] CoGetContextToken (in: pToken=0x586b8cc | out: pToken=0x586b8cc) returned 0x0
	[0178.392] CoGetContextToken (in: pToken=0x586af84 | out: pToken=0x586af84) returned 0x0
	[0178.393] CoGetContextToken (in: pToken=0x586b394 | out: pToken=0x586b394) returned 0x0
	[0178.393] CoGetContextToken (in: pToken=0x586b964 | out: pToken=0x586b964) returned 0x0
	[0178.393] CoGetContextToken (in: pToken=0x586b8c4 | out: pToken=0x586b8c4) returned 0x0
	[0178.654] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.BackgroundIntelligentTransfer.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.BackgroundIntelligentTransfer.Management.dll", nBufferLength=0x105, lpBuffer=0x586b7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.BackgroundIntelligentTransfer.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.BackgroundIntelligentTransfer.Management.dll", lpFilePart=0x0) returned 0xa0
	[0178.664] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.BackgroundIntelligentTransfer.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.BackgroundIntelligentTransfer.Management.dll", nBufferLength=0x105, lpBuffer=0x586b694, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.BackgroundIntelligentTransfer.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.BackgroundIntelligentTransfer.Management.dll", lpFilePart=0x0) returned 0xa0
	[0178.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0178.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0178.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586df6c) returned 1
	[0178.880] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c2fe50 | out: lpFileInformation=0x2c2fe50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a2760e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x14a2760e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37b3dedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3b6)) returned 1
	[0178.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586df68) returned 1
	[0178.884] EtwEventActivityIdControl () returned 0x0
	[0178.884] EtwEventActivityIdControl () returned 0x0
	[0178.885] SetEvent (hEvent=0x40c) returned 1
	[0178.885] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x586e74c*=0x40c, lpdwindex=0x586e570 | out: lpdwindex=0x586e570) returned 0x0
	[0178.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52
	[0178.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51
	[0178.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e62c) returned 1
	[0178.886] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c3168c | out: lpFileInformation=0x2c3168c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a2760e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x14a2760e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37b3dedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3b6)) returned 1
	[0178.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e628) returned 1
	[0178.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0178.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e
	[0178.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d
	[0178.888] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a710
	[0178.888] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.888] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a3e9e0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x90a3e9e0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x5eaf6a81, ftLastWriteTime.dwHighDateTime=0x1d21d41, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets.psd1", cAlternateFileName="")) returned 1
	[0178.888] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a3e9e0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x90a3e9e0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x5eaf6a81, ftLastWriteTime.dwHighDateTime=0x1d21d41, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets.psd1", cAlternateFileName="")) returned 0
	[0178.888] FindClose (in: hFindFile=0x5b6a710 | out: hFindFile=0x5b6a710) returned 1
	[0178.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0178.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0178.889] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20
	[0178.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e
	[0178.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x4e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", lpFilePart=0x0) returned 0x4d
	[0178.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e
	[0178.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x4e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", lpFilePart=0x0) returned 0x4d
	[0178.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0178.890] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c31d3c | out: lpFileInformation=0x2c31d3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a3e9e0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x90a3e9e0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x5eaf6a81, ftLastWriteTime.dwHighDateTime=0x1d21d41, nFileSizeHigh=0x0, nFileSizeLow=0x75e)) returned 1
	[0178.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0178.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e
	[0178.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x4e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", lpFilePart=0x0) returned 0x4d
	[0178.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0178.891] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444
	[0178.891] GetFileType (hFile=0x444) returned 0x1
	[0178.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0178.891] GetFileType (hFile=0x444) returned 0x1
	[0178.891] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0178.892] ReadFile (in: hFile=0x444, lpBuffer=0x2c32b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c32b24*, lpNumberOfBytesRead=0x586e884*=0x75e, lpOverlapped=0x0) returned 1
	[0178.894] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x75e
	[0178.895] ReadFile (in: hFile=0x444, lpBuffer=0x2c32216, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c32216*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.895] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x75e
	[0178.895] ReadFile (in: hFile=0x444, lpBuffer=0x2c32b24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c32b24*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.895] CloseHandle (hObject=0x444) returned 1
	[0178.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0178.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37
	[0178.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36
	[0178.898] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a710
	[0178.898] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.899] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91991780, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x91991780, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x4209d5bf, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="ise.psd1", cAlternateFileName="")) returned 1
	[0178.899] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911aeea0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x911aeea0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x4209d5bf, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x3474, dwReserved0=0x0, dwReserved1=0x0, cFileName="ise.psm1", cAlternateFileName="")) returned 1
	[0178.899] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911aeea0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x911aeea0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x4209d5bf, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x3474, dwReserved0=0x0, dwReserved1=0x0, cFileName="ise.psm1", cAlternateFileName="")) returned 0
	[0178.899] FindClose (in: hFindFile=0x5b6a710 | out: hFindFile=0x5b6a710) returned 1
	[0178.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0178.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0178.899] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20
	[0178.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40
	[0178.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1", nBufferLength=0x40, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1", lpFilePart=0x0) returned 0x3f
	[0178.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40
	[0178.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1", nBufferLength=0x40, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1", lpFilePart=0x0) returned 0x3f
	[0178.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0178.900] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c3a5f4 | out: lpFileInformation=0x2c3a5f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91991780, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x91991780, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x4209d5bf, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x208)) returned 1
	[0178.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0178.902] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40
	[0178.902] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1", nBufferLength=0x40, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1", lpFilePart=0x0) returned 0x3f
	[0178.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0178.902] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444
	[0178.903] GetFileType (hFile=0x444) returned 0x1
	[0178.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0178.903] GetFileType (hFile=0x444) returned 0x1
	[0178.903] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0178.903] ReadFile (in: hFile=0x444, lpBuffer=0x2c3b3c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c3b3c4*, lpNumberOfBytesRead=0x586e884*=0x208, lpOverlapped=0x0) returned 1
	[0178.906] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x208
	[0178.906] ReadFile (in: hFile=0x444, lpBuffer=0x2c3b3c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c3b3c4*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.906] CloseHandle (hObject=0x444) returned 1
	[0178.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0178.907] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50
	[0178.907] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f
	[0178.907] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a710
	[0178.908] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.908] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0178.908] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1a8e27, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive.psd1", cAlternateFileName="")) returned 1
	[0178.908] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d783500, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8d783500, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1de9cd, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x19bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive.psm1", cAlternateFileName="")) returned 1
	[0178.908] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d783500, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8d783500, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1de9cd, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x19bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive.psm1", cAlternateFileName="")) returned 0
	[0178.908] FindClose (in: hFindFile=0x5b6a710 | out: hFindFile=0x5b6a710) returned 1
	[0178.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0178.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0178.909] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20
	[0178.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72
	[0178.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x72, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", lpFilePart=0x0) returned 0x71
	[0178.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72
	[0178.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x72, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", lpFilePart=0x0) returned 0x71
	[0178.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0178.910] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c40944 | out: lpFileInformation=0x2c40944*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1a8e27, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x1c8)) returned 1
	[0178.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0178.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72
	[0178.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x72, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", lpFilePart=0x0) returned 0x71
	[0178.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0178.911] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444
	[0178.911] GetFileType (hFile=0x444) returned 0x1
	[0178.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0178.911] GetFileType (hFile=0x444) returned 0x1
	[0178.912] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0178.912] ReadFile (in: hFile=0x444, lpBuffer=0x2c41774, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c41774*, lpNumberOfBytesRead=0x586e884*=0x1c8, lpOverlapped=0x0) returned 1
	[0178.914] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x1c8
	[0178.914] ReadFile (in: hFile=0x444, lpBuffer=0x2c41774, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c41774*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.914] CloseHandle (hObject=0x444) returned 1
	[0178.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0178.916] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0178.916] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53
	[0178.916] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a710
	[0178.917] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.917] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e37f4, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics.psd1", cAlternateFileName="")) returned 1
	[0178.917] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e37f4, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics.psd1", cAlternateFileName="")) returned 0
	[0178.917] FindClose (in: hFindFile=0x5b6a710 | out: hFindFile=0x5b6a710) returned 1
	[0178.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0178.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0178.917] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20
	[0178.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x7a
	[0178.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x7a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", lpFilePart=0x0) returned 0x79
	[0178.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x7a
	[0178.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x7a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", lpFilePart=0x0) returned 0x79
	[0178.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0178.918] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c4663c | out: lpFileInformation=0x2c4663c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e37f4, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x288)) returned 1
	[0178.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0178.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x7a
	[0178.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x7a, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", lpFilePart=0x0) returned 0x79
	[0178.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0178.919] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444
	[0178.920] GetFileType (hFile=0x444) returned 0x1
	[0178.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0178.920] GetFileType (hFile=0x444) returned 0x1
	[0178.920] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0178.920] ReadFile (in: hFile=0x444, lpBuffer=0x2c4747c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c4747c*, lpNumberOfBytesRead=0x586e884*=0x288, lpOverlapped=0x0) returned 1
	[0178.922] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x288
	[0178.922] ReadFile (in: hFile=0x444, lpBuffer=0x2c4747c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c4747c*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.923] CloseHandle (hObject=0x444) returned 1
	[0178.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0178.924] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d
	[0178.924] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c
	[0178.925] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a710
	[0178.925] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.925] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e37f4, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host.psd1", cAlternateFileName="")) returned 1
	[0178.925] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e37f4, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host.psd1", cAlternateFileName="")) returned 0
	[0178.925] FindClose (in: hFindFile=0x5b6a710 | out: hFindFile=0x5b6a710) returned 1
	[0178.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0178.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0178.926] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20
	[0178.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6c
	[0178.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x6c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", lpFilePart=0x0) returned 0x6b
	[0178.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6c
	[0178.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x6c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", lpFilePart=0x0) returned 0x6b
	[0178.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0178.927] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c4d034 | out: lpFileInformation=0x2c4d034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e37f4, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x1d4)) returned 1
	[0178.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0178.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6c
	[0178.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x6c, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", lpFilePart=0x0) returned 0x6b
	[0178.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0178.928] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444
	[0178.928] GetFileType (hFile=0x444) returned 0x1
	[0178.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0178.928] GetFileType (hFile=0x444) returned 0x1
	[0178.929] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0178.929] ReadFile (in: hFile=0x444, lpBuffer=0x2c4de5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c4de5c*, lpNumberOfBytesRead=0x586e884*=0x1d4, lpOverlapped=0x0) returned 1
	[0178.931] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x1d4
	[0178.931] ReadFile (in: hFile=0x444, lpBuffer=0x2c4de5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c4de5c*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.931] CloseHandle (hObject=0x444) returned 1
	[0178.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0178.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53
	[0178.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52
	[0178.932] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a710
	[0178.934] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.934] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0178.935] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d7f5920, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8d7f5920, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xdd1c5fc, ftLastWriteTime.dwHighDateTime=0x1d21d41, nFileSizeHigh=0x0, nFileSizeLow=0x29c5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataAdapter.ps1", cAlternateFileName="")) returned 1
	[0178.935] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb11da0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8fb11da0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xdd34cbd, ftLastWriteTime.dwHighDateTime=0x1d21d41, nFileSizeHigh=0x0, nFileSizeLow=0x6194, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils.psd1", cAlternateFileName="")) returned 1
	[0178.935] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xdd34cbd, ftLastWriteTime.dwHighDateTime=0x1d21d41, nFileSizeHigh=0x0, nFileSizeLow=0x4f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils.psm1", cAlternateFileName="")) returned 1
	[0178.935] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9598a6c0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x9598a6c0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xde7c0cc, ftLastWriteTime.dwHighDateTime=0x1d21d41, nFileSizeHigh=0x0, nFileSizeLow=0xc94a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtilsHelper.ps1", cAlternateFileName="")) returned 1
	[0178.935] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d926420, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8d926420, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xded8da9, ftLastWriteTime.dwHighDateTime=0x1d21d41, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataV4Adapter.ps1", cAlternateFileName="")) returned 1
	[0178.935] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d926420, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8d926420, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xded8da9, ftLastWriteTime.dwHighDateTime=0x1d21d41, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataV4Adapter.ps1", cAlternateFileName="")) returned 0
	[0178.935] FindClose (in: hFindFile=0x5b6a710 | out: hFindFile=0x5b6a710) returned 1
	[0178.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0178.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0178.937] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20
	[0178.938] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0178.938] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", lpFilePart=0x0) returned 0x77
	[0178.938] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0178.938] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", lpFilePart=0x0) returned 0x77
	[0178.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0178.939] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c52e84 | out: lpFileInformation=0x2c52e84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb11da0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8fb11da0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xdd34cbd, ftLastWriteTime.dwHighDateTime=0x1d21d41, nFileSizeHigh=0x0, nFileSizeLow=0x6194)) returned 1
	[0178.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0178.939] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78
	[0178.939] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x78, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", lpFilePart=0x0) returned 0x77
	[0178.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0178.940] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444
	[0178.940] GetFileType (hFile=0x444) returned 0x1
	[0178.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0178.940] GetFileType (hFile=0x444) returned 0x1
	[0178.941] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0178.941] ReadFile (in: hFile=0x444, lpBuffer=0x2c53cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c53cc4*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0178.944] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x1000
	[0178.944] ReadFile (in: hFile=0x444, lpBuffer=0x2c53cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c53cc4*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0178.945] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x2000
	[0178.945] ReadFile (in: hFile=0x444, lpBuffer=0x2c53cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c53cc4*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0178.946] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x3000
	[0178.946] ReadFile (in: hFile=0x444, lpBuffer=0x2c53cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c53cc4*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0178.947] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x4000
	[0178.947] ReadFile (in: hFile=0x444, lpBuffer=0x2c53cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c53cc4*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0178.947] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x5000
	[0178.947] ReadFile (in: hFile=0x444, lpBuffer=0x2c53cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c53cc4*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0178.948] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x6000
	[0178.948] ReadFile (in: hFile=0x444, lpBuffer=0x2c53cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c53cc4*, lpNumberOfBytesRead=0x586e884*=0x194, lpOverlapped=0x0) returned 1
	[0178.948] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x6194
	[0178.948] ReadFile (in: hFile=0x444, lpBuffer=0x2c53cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c53cc4*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.949] CloseHandle (hObject=0x444) returned 1
	[0178.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0178.960] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51
	[0178.960] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50
	[0178.960] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a710
	[0178.961] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.961] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security.psd1", cAlternateFileName="")) returned 1
	[0178.961] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security.psd1", cAlternateFileName="")) returned 0
	[0178.961] FindClose (in: hFindFile=0x5b6a710 | out: hFindFile=0x5b6a710) returned 1
	[0178.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0178.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0178.961] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20
	[0178.962] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x74
	[0178.962] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x74, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", lpFilePart=0x0) returned 0x73
	[0178.962] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x74
	[0178.962] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x74, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", lpFilePart=0x0) returned 0x73
	[0178.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0178.962] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c7af44 | out: lpFileInformation=0x2c7af44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x2ef)) returned 1
	[0178.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0178.963] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x74
	[0178.963] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x74, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", lpFilePart=0x0) returned 0x73
	[0178.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0178.963] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444
	[0178.964] GetFileType (hFile=0x444) returned 0x1
	[0178.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0178.964] GetFileType (hFile=0x444) returned 0x1
	[0178.964] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0178.964] ReadFile (in: hFile=0x444, lpBuffer=0x2c7bd7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c7bd7c*, lpNumberOfBytesRead=0x586e884*=0x2ef, lpOverlapped=0x0) returned 1
	[0178.966] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x2ef
	[0178.966] ReadFile (in: hFile=0x444, lpBuffer=0x2c7bd7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c7bd7c*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.967] CloseHandle (hObject=0x444) returned 1
	[0178.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0178.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e
	[0178.968] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d
	[0178.968] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a710
	[0178.968] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.968] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f88a640, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8f88a640, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.psd1", cAlternateFileName="")) returned 1
	[0178.968] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f88a640, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8f88a640, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.psd1", cAlternateFileName="")) returned 0
	[0178.968] FindClose (in: hFindFile=0x5b6a710 | out: hFindFile=0x5b6a710) returned 1
	[0178.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0178.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0178.969] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20
	[0178.969] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6e
	[0178.969] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x6e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", lpFilePart=0x0) returned 0x6d
	[0178.970] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6e
	[0178.970] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x6e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", lpFilePart=0x0) returned 0x6d
	[0178.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0178.970] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c82358 | out: lpFileInformation=0x2c82358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f88a640, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8f88a640, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x2ea)) returned 1
	[0178.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0178.970] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6e
	[0178.970] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x6e, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", lpFilePart=0x0) returned 0x6d
	[0178.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0178.971] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444
	[0178.971] GetFileType (hFile=0x444) returned 0x1
	[0178.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0178.971] GetFileType (hFile=0x444) returned 0x1
	[0178.972] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0178.972] ReadFile (in: hFile=0x444, lpBuffer=0x2c83180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c83180*, lpNumberOfBytesRead=0x586e884*=0x2ea, lpOverlapped=0x0) returned 1
	[0178.974] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x2ea
	[0178.974] ReadFile (in: hFile=0x444, lpBuffer=0x2c83180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c83180*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.975] CloseHandle (hObject=0x444) returned 1
	[0178.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0178.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f
	[0178.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e
	[0178.976] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a710
	[0178.979] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.979] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e794980, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e794980, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x140a5651, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x479, dwReserved0=0x0, dwReserved1=0x0, cFileName="Disable-DscDebug.cdxml", cAlternateFileName="")) returned 1
	[0178.979] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x497da680, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSCClassResources", cAlternateFileName="DSCCLA~1")) returned 1
	[0178.979] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4971bfa0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSCResources", cAlternateFileName="DSCRES~1")) returned 1
	[0178.979] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4971bfa0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x4971bfa0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4971bfa0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0178.979] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2abc20, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2abc20, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x140a5651, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Enable-DscDebug.cdxml", cAlternateFileName="")) returned 1
	[0178.979] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911fb160, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x911fb160, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x140a5651, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get-DscConfiguration.cdxml", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91436600, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x91436600, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x140a5651, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x5f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get-DscConfigurationStatus.cdxml", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911fb160, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x911fb160, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x140aa479, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get-DSCLocalConfigurationManager.cdxml", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fbaa320, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8fbaa320, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x16118527, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x3f4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration.format.ps1xml", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e617bc0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e617bc0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x16118527, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x13da, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration.psd1", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9002c0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8d9002c0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x16224f68, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x30f02, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration.psm1", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91d23880, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x91d23880, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x16224f68, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration.types.ps1xml", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f4d8a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x90f4d8a0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x173b77b8, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x2ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDscXMachine.psm1", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2abc20, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2abc20, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x140e9c6c, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x95d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remove-DscConfigurationDocument.cdxml", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912df9a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x912df9a0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x140e9c6c, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Restore-DscConfiguration.cdxml", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2abc20, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2abc20, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x140eea8f, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x5a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stop-DscConfiguration.cdxml", cAlternateFileName="")) returned 1
	[0178.980] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4971bfa0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x4971bfa0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4971bfa0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebDownloadManager", cAlternateFileName="WEBDOW~1")) returned 1
	[0178.981] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0178.981] FindClose (in: hFindFile=0x5b6a710 | out: hFindFile=0x5b6a710) returned 1
	[0178.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0178.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0178.982] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20
	[0178.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x70
	[0178.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1", nBufferLength=0x70, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1", lpFilePart=0x0) returned 0x6f
	[0178.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x70
	[0178.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1", nBufferLength=0x70, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1", lpFilePart=0x0) returned 0x6f
	[0178.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0178.985] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c89b38 | out: lpFileInformation=0x2c89b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e617bc0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e617bc0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x16118527, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x13da)) returned 1
	[0178.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0178.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x70
	[0178.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1", nBufferLength=0x70, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1", lpFilePart=0x0) returned 0x6f
	[0178.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0178.986] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444
	[0178.986] GetFileType (hFile=0x444) returned 0x1
	[0178.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0178.986] GetFileType (hFile=0x444) returned 0x1
	[0178.986] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0178.987] ReadFile (in: hFile=0x444, lpBuffer=0x2c8a968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c8a968*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0178.990] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x1000
	[0178.990] ReadFile (in: hFile=0x444, lpBuffer=0x2c8a968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c8a968*, lpNumberOfBytesRead=0x586e884*=0x3da, lpOverlapped=0x0) returned 1
	[0178.990] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x13da
	[0178.990] ReadFile (in: hFile=0x444, lpBuffer=0x2c8a968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c8a968*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.991] CloseHandle (hObject=0x444) returned 1
	[0178.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0178.994] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41
	[0178.994] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40
	[0178.994] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a710
	[0178.994] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.994] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8100bf6e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c28927f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c28927f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics.psd1", cAlternateFileName="PSDIAG~1.PSD")) returned 1
	[0178.994] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8100bf6e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c28927f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c28927f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics.psm1", cAlternateFileName="PSDIAG~1.PSM")) returned 1
	[0178.995] FindNextFileW (in: hFindFile=0x5b6a710, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8100bf6e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c28927f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c28927f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics.psm1", cAlternateFileName="PSDIAG~1.PSM")) returned 0
	[0178.995] FindClose (in: hFindFile=0x5b6a710 | out: hFindFile=0x5b6a710) returned 1
	[0178.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0178.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0178.995] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20
	[0178.995] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0178.995] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0178.995] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0178.996] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0178.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0178.996] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2c96a68 | out: lpFileInformation=0x2c96a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8100bf6e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c28927f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c28927f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x266)) returned 1
	[0178.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0178.996] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0178.996] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0178.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0178.996] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444
	[0178.997] GetFileType (hFile=0x444) returned 0x1
	[0178.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0178.997] GetFileType (hFile=0x444) returned 0x1
	[0178.997] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0178.997] ReadFile (in: hFile=0x444, lpBuffer=0x2c97860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c97860*, lpNumberOfBytesRead=0x586e884*=0x266, lpOverlapped=0x0) returned 1
	[0178.999] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x266
	[0178.999] ReadFile (in: hFile=0x444, lpBuffer=0x2c97860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2c97860*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0178.999] CloseHandle (hObject=0x444) returned 1
	[0179.000] CoCreateGuid (in: pguid=0x586e8c4 | out: pguid=0x586e8c4*(Data1=0xca9cf1d6, Data2=0x971e, Data3=0x4d28, Data4=([0]=0xb5, [1]=0xf0, [2]=0xb, [3]=0x2c, [4]=0x1, [5]=0xb3, [6]=0xaf, [7]=0xfa))) returned 0x0
	[0179.000] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x444
	[0179.000] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x44c
	[0179.001] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x450
	[0179.001] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x454
	[0179.001] SetEvent (hEvent=0x454) returned 1
	[0179.001] SetEvent (hEvent=0x444) returned 1
	[0179.001] SetEvent (hEvent=0x44c) returned 1
	[0179.001] SetEvent (hEvent=0x450) returned 1
	[0179.002] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x458
	[0179.002] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0179.004] EtwEventActivityIdControl () returned 0x0
	[0179.004] EtwEventActivityIdControl () returned 0x0
	[0179.004] EtwEventActivityIdControl () returned 0x0
	[0179.012] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20
	[0179.013] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.013] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.013] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586e1fc, Length=0x20, ResultLength=0x586e26c | out: SystemInformation=0x586e1fc, ResultLength=0x586e26c*=0x0) returned 0xc0000003
	[0179.013] GetSystemInfo (in: lpSystemInfo=0x586e278 | out: lpSystemInfo=0x586e278*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0179.014] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586e208 | out: phkResult=0x586e208*=0x460) returned 0x0
	[0179.014] RegQueryValueExW (in: hKey=0x460, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586e224, lpData=0x0, lpcbData=0x586e220*=0x0 | out: lpType=0x586e224*=0x0, lpData=0x0, lpcbData=0x586e220*=0x0) returned 0x2
	[0179.014] RegCloseKey (hKey=0x460) returned 0x0
	[0179.015] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.015] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e180) returned 1
	[0179.015] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x460
	[0179.015] GetFileType (hFile=0x460) returned 0x1
	[0179.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e17c) returned 1
	[0179.015] GetFileType (hFile=0x460) returned 0x1
	[0179.016] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x0
	[0179.016] ReadFile (in: hFile=0x460, lpBuffer=0x2ca47fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2ca47fc*, lpNumberOfBytesRead=0x586e1e8*=0x266, lpOverlapped=0x0) returned 1
	[0179.016] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x266
	[0179.016] ReadFile (in: hFile=0x460, lpBuffer=0x2ca47fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2ca47fc*, lpNumberOfBytesRead=0x586e1e8*=0x0, lpOverlapped=0x0) returned 1
	[0179.016] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586e150, Length=0x20, ResultLength=0x586e1c0 | out: SystemInformation=0x586e150, ResultLength=0x586e1c0*=0x0) returned 0xc0000003
	[0179.017] GetSystemInfo (in: lpSystemInfo=0x586e1cc | out: lpSystemInfo=0x586e1cc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0179.017] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586e15c | out: phkResult=0x586e15c*=0x464) returned 0x0
	[0179.017] RegQueryValueExW (in: hKey=0x464, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586e178, lpData=0x0, lpcbData=0x586e174*=0x0 | out: lpType=0x586e178*=0x0, lpData=0x0, lpcbData=0x586e174*=0x0) returned 0x2
	[0179.017] RegCloseKey (hKey=0x464) returned 0x0
	[0179.017] CloseHandle (hObject=0x460) returned 1
	[0179.018] CoCreateGuid (in: pguid=0x586e24c | out: pguid=0x586e24c*(Data1=0x53677c4c, Data2=0x340a, Data3=0x426a, Data4=([0]=0xbf, [1]=0xdc, [2]=0x85, [3]=0x3, [4]=0xdd, [5]=0xce, [6]=0x4c, [7]=0x39))) returned 0x0
	[0179.019] QueryPerformanceCounter (in: lpPerformanceCount=0x586dfac | out: lpPerformanceCount=0x586dfac*=2532323111207) returned 1
	[0179.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586dc98) returned 1
	[0179.019] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586df5c | out: lpFileInformation=0x586df5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8100bf6e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c28927f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c28927f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x266)) returned 1
	[0179.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dc94) returned 1
	[0179.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586dc2c) returned 1
	[0179.020] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586def0 | out: lpFileInformation=0x586def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8100bf6e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c28927f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c28927f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x266)) returned 1
	[0179.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dc28) returned 1
	[0179.020] CoTaskMemAlloc (cb=0x10) returned 0x5b72788
	[0179.020] CoTaskMemAlloc (cb=0x10) returned 0x5b72758
	[0179.020] CoTaskMemAlloc (cb=0xa8) returned 0x5b5a898
	[0179.021] CoTaskMemAlloc (cb=0x30) returned 0x335800
	[0179.021] WinVerifyTrust () returned 0x800b0100
	[0179.035] CoTaskMemFree (pv=0x5b72788) 
	[0179.035] CoTaskMemFree (pv=0x335800) 
	[0179.035] CryptCATHandleFromStore () returned 0x2d6370
	[0179.035] WTHelperGetProvSignerFromChain () returned 0x0
	[0179.035] CoTaskMemAlloc (cb=0x10) returned 0x5b72788
	[0179.035] CoTaskMemAlloc (cb=0x30) returned 0x335800
	[0179.035] WinVerifyTrust () returned 0x0
	[0179.036] CoTaskMemFree (pv=0x335800) 
	[0179.036] CoTaskMemFree (pv=0x5b72788) 
	[0179.036] CoTaskMemFree (pv=0x5b5a898) 
	[0179.036] CoTaskMemFree (pv=0x5b72758) 
	[0179.045] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\en-US\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\en-us\\psdiagnostics.psd1")) returned 0xffffffff
	[0179.045] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\en\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\en\\psdiagnostics.psd1")) returned 0xffffffff
	[0179.049] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.059] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.067] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.078] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.085] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.092] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.099] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.107] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.115] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.127] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.137] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.145] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.154] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.163] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.168] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.168] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.168] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41
	[0179.168] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40
	[0179.172] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55
	[0179.172] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSGetModuleInfo.xml", nBufferLength=0x55, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x54
	[0179.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d6e8) returned 1
	[0179.172] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x586d9ac | out: lpFileInformation=0x586d9ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d6e4) returned 1
	[0179.172] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f
	[0179.172] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics", nBufferLength=0x4f, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics", lpFilePart=0x0) returned 0x4e
	[0179.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d5e8) returned 1
	[0179.172] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x586d8ac | out: lpFileInformation=0x586d8ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d5e4) returned 1
	[0179.176] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20
	[0179.176] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20
	[0179.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.177] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586d46c, Length=0x20, ResultLength=0x586d4dc | out: SystemInformation=0x586d46c, ResultLength=0x586d4dc*=0x0) returned 0xc0000003
	[0179.177] GetSystemInfo (in: lpSystemInfo=0x586d4e8 | out: lpSystemInfo=0x586d4e8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0179.177] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d478 | out: phkResult=0x586d478*=0x464) returned 0x0
	[0179.178] RegQueryValueExW (in: hKey=0x464, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586d494, lpData=0x0, lpcbData=0x586d490*=0x0 | out: lpType=0x586d494*=0x0, lpData=0x0, lpcbData=0x586d490*=0x0) returned 0x2
	[0179.178] RegCloseKey (hKey=0x464) returned 0x0
	[0179.178] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.178] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d3f0) returned 1
	[0179.178] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x464
	[0179.179] GetFileType (hFile=0x464) returned 0x1
	[0179.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d3ec) returned 1
	[0179.179] GetFileType (hFile=0x464) returned 0x1
	[0179.179] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d42c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d42c*=0) returned 0x0
	[0179.179] ReadFile (in: hFile=0x464, lpBuffer=0x2d071f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d458, lpOverlapped=0x0 | out: lpBuffer=0x2d071f4*, lpNumberOfBytesRead=0x586d458*=0x266, lpOverlapped=0x0) returned 1
	[0179.179] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586d42c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586d42c*=0) returned 0x266
	[0179.179] ReadFile (in: hFile=0x464, lpBuffer=0x2d071f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586d458, lpOverlapped=0x0 | out: lpBuffer=0x2d071f4*, lpNumberOfBytesRead=0x586d458*=0x0, lpOverlapped=0x0) returned 1
	[0179.180] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586d3c0, Length=0x20, ResultLength=0x586d430 | out: SystemInformation=0x586d3c0, ResultLength=0x586d430*=0x0) returned 0xc0000003
	[0179.180] GetSystemInfo (in: lpSystemInfo=0x586d43c | out: lpSystemInfo=0x586d43c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0179.180] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d3cc | out: phkResult=0x586d3cc*=0x468) returned 0x0
	[0179.181] RegQueryValueExW (in: hKey=0x468, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586d3e8, lpData=0x0, lpcbData=0x586d3e4*=0x0 | out: lpType=0x586d3e8*=0x0, lpData=0x0, lpcbData=0x586d3e4*=0x0) returned 0x2
	[0179.181] RegCloseKey (hKey=0x468) returned 0x0
	[0179.181] CloseHandle (hObject=0x464) returned 1
	[0179.211] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\en-US\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\en-us\\psdiagnostics.psd1")) returned 0xffffffff
	[0179.211] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\en\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\en\\psdiagnostics.psd1")) returned 0xffffffff
	[0179.215] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.223] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.232] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.240] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.247] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.254] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.261] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.269] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.277] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.284] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.291] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.299] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.307] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.314] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics")) returned 0xffffffff
	[0179.318] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41
	[0179.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40
	[0179.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55
	[0179.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSGetModuleInfo.xml", nBufferLength=0x55, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x54
	[0179.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586c958) returned 1
	[0179.323] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x586cc1c | out: lpFileInformation=0x586cc1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586c954) returned 1
	[0179.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f
	[0179.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics", nBufferLength=0x4f, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics", lpFilePart=0x0) returned 0x4e
	[0179.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586c858) returned 1
	[0179.323] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x586cb1c | out: lpFileInformation=0x586cb1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586c854) returned 1
	[0179.330] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psm1")) returned 0x20
	[0179.330] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psm1")) returned 0x20
	[0179.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1", lpFilePart=0x0) returned 0x53
	[0179.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586c3d8) returned 1
	[0179.331] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2d67010 | out: lpFileInformation=0x2d67010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8100bf6e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c28927f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c28927f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8d7c)) returned 1
	[0179.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586c3d4) returned 1
	[0179.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1", lpFilePart=0x0) returned 0x53
	[0179.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586c57c) returned 1
	[0179.332] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x464
	[0179.332] GetFileType (hFile=0x464) returned 0x1
	[0179.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586c578) returned 1
	[0179.332] GetFileType (hFile=0x464) returned 0x1
	[0179.332] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x0
	[0179.332] ReadFile (in: hFile=0x464, lpBuffer=0x2d67df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67df8*, lpNumberOfBytesRead=0x586c5e4*=0x1000, lpOverlapped=0x0) returned 1
	[0179.335] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x1000
	[0179.335] ReadFile (in: hFile=0x464, lpBuffer=0x2d67df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67df8*, lpNumberOfBytesRead=0x586c5e4*=0x1000, lpOverlapped=0x0) returned 1
	[0179.336] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x2000
	[0179.336] ReadFile (in: hFile=0x464, lpBuffer=0x2d67df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67df8*, lpNumberOfBytesRead=0x586c5e4*=0x1000, lpOverlapped=0x0) returned 1
	[0179.336] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x3000
	[0179.336] ReadFile (in: hFile=0x464, lpBuffer=0x2d67df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67df8*, lpNumberOfBytesRead=0x586c5e4*=0x1000, lpOverlapped=0x0) returned 1
	[0179.337] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x4000
	[0179.337] ReadFile (in: hFile=0x464, lpBuffer=0x2d67df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67df8*, lpNumberOfBytesRead=0x586c5e4*=0x1000, lpOverlapped=0x0) returned 1
	[0179.338] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x5000
	[0179.338] ReadFile (in: hFile=0x464, lpBuffer=0x2d67df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67df8*, lpNumberOfBytesRead=0x586c5e4*=0x1000, lpOverlapped=0x0) returned 1
	[0179.338] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x6000
	[0179.338] ReadFile (in: hFile=0x464, lpBuffer=0x2d67df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67df8*, lpNumberOfBytesRead=0x586c5e4*=0x1000, lpOverlapped=0x0) returned 1
	[0179.338] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x7000
	[0179.338] ReadFile (in: hFile=0x464, lpBuffer=0x2d67df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67df8*, lpNumberOfBytesRead=0x586c5e4*=0x1000, lpOverlapped=0x0) returned 1
	[0179.339] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x8000
	[0179.339] ReadFile (in: hFile=0x464, lpBuffer=0x2d67df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67df8*, lpNumberOfBytesRead=0x586c5e4*=0xd7c, lpOverlapped=0x0) returned 1
	[0179.339] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x8d7c
	[0179.339] ReadFile (in: hFile=0x464, lpBuffer=0x2d67308, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67308*, lpNumberOfBytesRead=0x586c5e4*=0x0, lpOverlapped=0x0) returned 1
	[0179.339] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586c5b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586c5b8*=0) returned 0x8d7c
	[0179.340] ReadFile (in: hFile=0x464, lpBuffer=0x2d67df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586c5e4, lpOverlapped=0x0 | out: lpBuffer=0x2d67df8*, lpNumberOfBytesRead=0x586c5e4*=0x0, lpOverlapped=0x0) returned 1
	[0179.340] CloseHandle (hObject=0x464) returned 1
	[0179.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1", lpFilePart=0x0) returned 0x53
	[0179.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586c33c) returned 1
	[0179.352] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2db7e24 | out: lpFileInformation=0x2db7e24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8100bf6e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c28927f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c28927f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8d7c)) returned 1
	[0179.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586c338) returned 1
	[0179.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586df6c) returned 1
	[0179.353] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2db90cc | out: lpFileInformation=0x2db90cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8100bf6e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c28927f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c28927f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x266)) returned 1
	[0179.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586df68) returned 1
	[0179.354] EtwEventActivityIdControl () returned 0x0
	[0179.354] SetEvent (hEvent=0x458) returned 1
	[0179.354] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x586e74c*=0x458, lpdwindex=0x586e570 | out: lpdwindex=0x586e570) returned 0x0
	[0179.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54
	[0179.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", nBufferLength=0x54, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1", lpFilePart=0x0) returned 0x53
	[0179.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e62c) returned 1
	[0179.355] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2dba86c | out: lpFileInformation=0x2dba86c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8100bf6e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c28927f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c28927f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x266)) returned 1
	[0179.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e628) returned 1
	[0179.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0179.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42
	[0179.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41
	[0179.355] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a750
	[0179.356] FindNextFileW (in: hFindFile=0x5b6a750, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0179.356] FindNextFileW (in: hFindFile=0x5b6a750, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904e3860, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x904e3860, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x4b5da8bd, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x1f06, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob.Format.ps1xml", cAlternateFileName="")) returned 1
	[0179.356] FindNextFileW (in: hFindFile=0x5b6a750, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905a1f40, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x905a1f40, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x4b5da8bd, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob.psd1", cAlternateFileName="")) returned 1
	[0179.356] FindNextFileW (in: hFindFile=0x5b6a750, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f73a00, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x90f73a00, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x4b5da8bd, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob.types.ps1xml", cAlternateFileName="")) returned 1
	[0179.356] FindNextFileW (in: hFindFile=0x5b6a750, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f73a00, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x90f73a00, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x4b5da8bd, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob.types.ps1xml", cAlternateFileName="")) returned 0
	[0179.356] FindClose (in: hFindFile=0x5b6a750 | out: hFindFile=0x5b6a750) returned 1
	[0179.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0179.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0179.356] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20
	[0179.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56
	[0179.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1", nBufferLength=0x56, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1", lpFilePart=0x0) returned 0x55
	[0179.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56
	[0179.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1", nBufferLength=0x56, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1", lpFilePart=0x0) returned 0x55
	[0179.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0179.357] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2dbb0c8 | out: lpFileInformation=0x2dbb0c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905a1f40, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x905a1f40, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x4b5da8bd, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x3ee)) returned 1
	[0179.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0179.358] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56
	[0179.358] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1", nBufferLength=0x56, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1", lpFilePart=0x0) returned 0x55
	[0179.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0179.358] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x464
	[0179.358] GetFileType (hFile=0x464) returned 0x1
	[0179.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0179.358] GetFileType (hFile=0x464) returned 0x1
	[0179.359] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0179.359] ReadFile (in: hFile=0x464, lpBuffer=0x2dbbec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2dbbec0*, lpNumberOfBytesRead=0x586e884*=0x3ee, lpOverlapped=0x0) returned 1
	[0179.361] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x3ee
	[0179.361] ReadFile (in: hFile=0x464, lpBuffer=0x2dbbec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2dbbec0*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0179.361] CloseHandle (hObject=0x464) returned 1
	[0179.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e93c) returned 1
	[0179.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47
	[0179.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46
	[0179.363] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\*", lpFindFileData=0x586e6ec | out: lpFindFileData=0x586e6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b6a750
	[0179.363] FindNextFileW (in: hFindFile=0x5b6a750, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0179.363] FindNextFileW (in: hFindFile=0x5b6a750, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e4bcac7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bb5ac3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0179.363] FindNextFileW (in: hFindFile=0x5b6a750, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91837f7c, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x91837f7c, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x91837f7c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x5075, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack.format.ps1xml", cAlternateFileName="")) returned 1
	[0179.363] FindNextFileW (in: hFindFile=0x5b6a750, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88a4ec5, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0xd88a4ec5, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x91837f7c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x5198, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack.psd1", cAlternateFileName="")) returned 1
	[0179.363] FindNextFileW (in: hFindFile=0x5b6a750, lpFindFileData=0x586e6f4 | out: lpFindFileData=0x586e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88a4ec5, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0xd88a4ec5, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x91837f7c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x5198, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack.psd1", cAlternateFileName="")) returned 0
	[0179.363] FindClose (in: hFindFile=0x5b6a750 | out: hFindFile=0x5b6a750) returned 1
	[0179.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6ac) returned 1
	[0179.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e90c) returned 1
	[0179.364] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20
	[0179.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0179.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0179.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0179.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0179.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e6b4) returned 1
	[0179.365] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2dc263c | out: lpFileInformation=0x2dc263c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88a4ec5, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0xd88a4ec5, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x91837f7c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x5198)) returned 1
	[0179.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e6b0) returned 1
	[0179.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0179.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0179.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e81c) returned 1
	[0179.366] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x464
	[0179.366] GetFileType (hFile=0x464) returned 0x1
	[0179.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e818) returned 1
	[0179.366] GetFileType (hFile=0x464) returned 0x1
	[0179.367] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x0
	[0179.367] ReadFile (in: hFile=0x464, lpBuffer=0x2dc344c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2dc344c*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0179.370] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x1000
	[0179.370] ReadFile (in: hFile=0x464, lpBuffer=0x2dc344c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2dc344c*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0179.371] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x2000
	[0179.371] ReadFile (in: hFile=0x464, lpBuffer=0x2dc344c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2dc344c*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0179.371] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x3000
	[0179.371] ReadFile (in: hFile=0x464, lpBuffer=0x2dc344c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2dc344c*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0179.372] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x4000
	[0179.372] ReadFile (in: hFile=0x464, lpBuffer=0x2dc344c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2dc344c*, lpNumberOfBytesRead=0x586e884*=0x1000, lpOverlapped=0x0) returned 1
	[0179.372] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x5000
	[0179.372] ReadFile (in: hFile=0x464, lpBuffer=0x2dc344c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2dc344c*, lpNumberOfBytesRead=0x586e884*=0x198, lpOverlapped=0x0) returned 1
	[0179.372] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e858*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e858*=0) returned 0x5198
	[0179.373] ReadFile (in: hFile=0x464, lpBuffer=0x2dc344c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e884, lpOverlapped=0x0 | out: lpBuffer=0x2dc344c*, lpNumberOfBytesRead=0x586e884*=0x0, lpOverlapped=0x0) returned 1
	[0179.386] CloseHandle (hObject=0x464) returned 1
	[0179.388] CoCreateGuid (in: pguid=0x586e8c4 | out: pguid=0x586e8c4*(Data1=0x72260d1c, Data2=0x5ca5, Data3=0x4135, Data4=([0]=0xb7, [1]=0x29, [2]=0x1f, [3]=0xbd, [4]=0xbb, [5]=0x94, [6]=0x8, [7]=0x9a))) returned 0x0
	[0179.389] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x464
	[0179.389] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x468
	[0179.389] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x46c
	[0179.389] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x470
	[0179.389] SetEvent (hEvent=0x470) returned 1
	[0179.390] SetEvent (hEvent=0x464) returned 1
	[0179.390] SetEvent (hEvent=0x468) returned 1
	[0179.390] SetEvent (hEvent=0x46c) returned 1
	[0179.390] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x474
	[0179.390] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0179.394] EtwEventActivityIdControl () returned 0x0
	[0179.394] EtwEventActivityIdControl () returned 0x0
	[0179.394] EtwEventActivityIdControl () returned 0x0
	[0179.404] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20
	[0179.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0179.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0179.405] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586e1fc, Length=0x20, ResultLength=0x586e26c | out: SystemInformation=0x586e1fc, ResultLength=0x586e26c*=0x0) returned 0xc0000003
	[0179.405] GetSystemInfo (in: lpSystemInfo=0x586e278 | out: lpSystemInfo=0x586e278*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0179.405] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586e208 | out: phkResult=0x586e208*=0x484) returned 0x0
	[0179.405] RegQueryValueExW (in: hKey=0x484, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586e224, lpData=0x0, lpcbData=0x586e220*=0x0 | out: lpType=0x586e224*=0x0, lpData=0x0, lpcbData=0x586e220*=0x0) returned 0x2
	[0179.406] RegCloseKey (hKey=0x484) returned 0x0
	[0179.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0179.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0179.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e180) returned 1
	[0179.406] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x484
	[0179.407] GetFileType (hFile=0x484) returned 0x1
	[0179.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e17c) returned 1
	[0179.407] GetFileType (hFile=0x484) returned 0x1
	[0179.407] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x0
	[0179.407] ReadFile (in: hFile=0x484, lpBuffer=0x2a0b2bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2a0b2bc*, lpNumberOfBytesRead=0x586e1e8*=0x1000, lpOverlapped=0x0) returned 1
	[0179.408] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x1000
	[0179.408] ReadFile (in: hFile=0x484, lpBuffer=0x2a0b2bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2a0b2bc*, lpNumberOfBytesRead=0x586e1e8*=0x1000, lpOverlapped=0x0) returned 1
	[0179.408] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x2000
	[0179.408] ReadFile (in: hFile=0x484, lpBuffer=0x2a0b2bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2a0b2bc*, lpNumberOfBytesRead=0x586e1e8*=0x1000, lpOverlapped=0x0) returned 1
	[0179.408] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x3000
	[0179.408] ReadFile (in: hFile=0x484, lpBuffer=0x2a0b2bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2a0b2bc*, lpNumberOfBytesRead=0x586e1e8*=0x1000, lpOverlapped=0x0) returned 1
	[0179.409] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x4000
	[0179.409] ReadFile (in: hFile=0x484, lpBuffer=0x2a0b2bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2a0b2bc*, lpNumberOfBytesRead=0x586e1e8*=0x1000, lpOverlapped=0x0) returned 1
	[0179.409] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x5000
	[0179.409] ReadFile (in: hFile=0x484, lpBuffer=0x2a0b2bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2a0b2bc*, lpNumberOfBytesRead=0x586e1e8*=0x198, lpOverlapped=0x0) returned 1
	[0179.409] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x586e1bc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x586e1bc*=0) returned 0x5198
	[0179.409] ReadFile (in: hFile=0x484, lpBuffer=0x2a0b2bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x586e1e8, lpOverlapped=0x0 | out: lpBuffer=0x2a0b2bc*, lpNumberOfBytesRead=0x586e1e8*=0x0, lpOverlapped=0x0) returned 1
	[0179.410] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x586e150, Length=0x20, ResultLength=0x586e1c0 | out: SystemInformation=0x586e150, ResultLength=0x586e1c0*=0x0) returned 0xc0000003
	[0179.410] GetSystemInfo (in: lpSystemInfo=0x586e1cc | out: lpSystemInfo=0x586e1cc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0179.410] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x586e15c | out: phkResult=0x586e15c*=0x488) returned 0x0
	[0179.411] RegQueryValueExW (in: hKey=0x488, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x586e178, lpData=0x0, lpcbData=0x586e174*=0x0 | out: lpType=0x586e178*=0x0, lpData=0x0, lpcbData=0x586e174*=0x0) returned 0x2
	[0179.411] RegCloseKey (hKey=0x488) returned 0x0
	[0179.411] CloseHandle (hObject=0x484) returned 1
	[0179.412] CoCreateGuid (in: pguid=0x586e24c | out: pguid=0x586e24c*(Data1=0x2c11b3a0, Data2=0x65e5, Data3=0x4a78, Data4=([0]=0xba, [1]=0x44, [2]=0x35, [3]=0xee, [4]=0xc1, [5]=0xd5, [6]=0x68, [7]=0x64))) returned 0x0
	[0179.412] QueryPerformanceCounter (in: lpPerformanceCount=0x586dfac | out: lpPerformanceCount=0x586dfac*=2532363216625) returned 1
	[0179.420] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0179.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0179.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586dc98) returned 1
	[0179.421] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586df5c | out: lpFileInformation=0x586df5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88a4ec5, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0xd88a4ec5, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x91837f7c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x5198)) returned 1
	[0179.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dc94) returned 1
	[0179.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0179.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0179.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0179.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0179.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586dc2c) returned 1
	[0179.422] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586def0 | out: lpFileInformation=0x586def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88a4ec5, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0xd88a4ec5, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x91837f7c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x5198)) returned 1
	[0179.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586dc28) returned 1
	[0179.422] CoTaskMemAlloc (cb=0x10) returned 0x5b72788
	[0179.422] CoTaskMemAlloc (cb=0x10) returned 0x5b727a0
	[0179.422] CoTaskMemAlloc (cb=0xc0) returned 0x2b6210
	[0179.423] CoTaskMemAlloc (cb=0x30) returned 0x327740
	[0179.423] WinVerifyTrust () returned 0x0
	[0180.927] CoTaskMemFree (pv=0x5b72788) 
	[0180.927] CoTaskMemFree (pv=0x327740) 
	[0180.927] CryptCATHandleFromStore () returned 0x2d6be0
	[0180.928] WTHelperGetProvSignerFromChain () returned 0x5b84ba0
	[0180.929] WTHelperGetProvCertFromChain () returned 0x5c265a8
	[0180.948] CertDuplicateCRLContext (pCrlContext=0x5b674e0) returned 0x5b674e0
	[0180.949] WTHelperGetProvCertFromChain () returned 0x5c26668
	[0180.951] CertDuplicateCRLContext (pCrlContext=0x5b67530) returned 0x5b67530
	[0180.952] CoTaskMemAlloc (cb=0x10) returned 0x5b72770
	[0180.952] CoTaskMemAlloc (cb=0x30) returned 0x327740
	[0180.952] WinVerifyTrust () returned 0x0
	[0180.952] CoTaskMemFree (pv=0x327740) 
	[0180.952] CoTaskMemFree (pv=0x5b72770) 
	[0180.952] CoTaskMemFree (pv=0x2b6210) 
	[0180.952] CoTaskMemFree (pv=0x5b727a0) 
	[0180.959] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\en-US\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\en-us\\troubleshootingpack.psd1")) returned 0xffffffff
	[0180.959] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\en\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\en\\troubleshootingpack.psd1")) returned 0xffffffff
	[0180.962] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0180.962] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0180.963] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47
	[0180.963] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46
	[0180.963] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x586d8e8 | out: phkResult=0x586d8e8*=0x484) returned 0x0
	[0180.963] RegQueryValueExW (in: hKey=0x484, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d908, lpData=0x0, lpcbData=0x586d904*=0x0 | out: lpType=0x586d908*=0x1, lpData=0x0, lpcbData=0x586d904*=0x56) returned 0x0
	[0180.964] RegQueryValueExW (in: hKey=0x484, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x586d908, lpData=0x2a2c554, lpcbData=0x586d904*=0x56 | out: lpType=0x586d908*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x586d904*=0x56) returned 0x0
	[0180.964] RegCloseKey (hKey=0x484) returned 0x0
	[0180.968] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.format.ps1xml")) returned 0x20
	[0180.972] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.format.ps1xml")) returned 0x20
	[0180.973] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.format.ps1xml")) returned 0x20
	[0180.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b
	[0180.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\PSGetModuleInfo.xml", nBufferLength=0x5b, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x5a
	[0180.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d6e8) returned 1
	[0180.978] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x586d9ac | out: lpFileInformation=0x586d9ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d6e4) returned 1
	[0180.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x77
	[0180.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x77, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack", lpFilePart=0x0) returned 0x76
	[0180.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d5e8) returned 1
	[0180.978] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x586d8ac | out: lpFileInformation=0x586d8ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d5e4) returned 1
	[0180.983] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psd1")) returned 0xffffffff
	[0180.989] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psm1")) returned 0xffffffff
	[0181.014] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.cdxml")) returned 0xffffffff
	[0181.019] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.xaml")) returned 0xffffffff
	[0181.024] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.ni.dll")) returned 0xffffffff
	[0181.029] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.dll")) returned 0xffffffff
	[0181.034] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psd1")) returned 0xffffffff
	[0181.039] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psm1")) returned 0xffffffff
	[0181.044] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.cdxml")) returned 0xffffffff
	[0181.048] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.xaml")) returned 0xffffffff
	[0181.051] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.ni.dll")) returned 0xffffffff
	[0181.055] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.dll")) returned 0xffffffff
	[0181.055] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x586d664, nSize=0xc6 | out: lpBuffer="") returned 0xc5
	[0181.059] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10
	[0181.060] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b
	[0181.060] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x5b, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack", lpFilePart=0x0) returned 0x5a
	[0181.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d4f0) returned 1
	[0181.060] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x586d7b4 | out: lpFileInformation=0x586d7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0181.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d4ec) returned 1
	[0181.065] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psd1")) returned 0xffffffff
	[0181.069] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psm1")) returned 0xffffffff
	[0181.073] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.cdxml")) returned 0xffffffff
	[0181.075] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.xaml")) returned 0xffffffff
	[0181.089] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10
	[0181.090] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61
	[0181.090] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x61, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack", lpFilePart=0x0) returned 0x60
	[0181.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d4f0) returned 1
	[0181.091] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x586d7b4 | out: lpFileInformation=0x586d7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0181.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d4ec) returned 1
	[0181.095] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psd1")) returned 0xffffffff
	[0181.099] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psm1")) returned 0xffffffff
	[0181.103] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.cdxml")) returned 0xffffffff
	[0181.107] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.xaml")) returned 0xffffffff
	[0181.112] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.ni.dll")) returned 0xffffffff
	[0181.117] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.dll")) returned 0xffffffff
	[0181.122] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10
	[0181.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63
	[0181.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x63, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack", lpFilePart=0x0) returned 0x62
	[0181.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586d4f0) returned 1
	[0181.123] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.windows.diagnosis.troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x586d7b4 | out: lpFileInformation=0x586d7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0181.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586d4ec) returned 1
	[0181.129] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psd1")) returned 0xffffffff
	[0181.133] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psm1")) returned 0xffffffff
	[0181.138] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.cdxml")) returned 0xffffffff
	[0181.143] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.xaml")) returned 0xffffffff
	[0181.147] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.ni.dll")) returned 0xffffffff
	[0181.151] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.windows.diagnosis.troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.dll")) returned 0xffffffff
	[0181.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x105, lpBuffer=0x586b800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack", lpFilePart=0x0) returned 0x76
	[0181.264] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x105, lpBuffer=0x586b788, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack", lpFilePart=0x0) returned 0x76
	[0181.545] CoGetContextToken (in: pToken=0x586af94 | out: pToken=0x586af94) returned 0x0
	[0181.545] CoGetContextToken (in: pToken=0x586af3c | out: pToken=0x586af3c) returned 0x0
	[0181.545] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x1, cHandles=0x1, pHandles=0x586af24*=0x378, lpdwindex=0x586addc | out: lpdwindex=0x586addc) returned 0x80010115
	[0181.547] CoGetContextToken (in: pToken=0x586a3e0 | out: pToken=0x586a3e0) returned 0x0
	[0181.547] CoGetContextToken (in: pToken=0x586a3c4 | out: pToken=0x586a3c4) returned 0x0
	[0181.547] CoGetContextToken (in: pToken=0x586a348 | out: pToken=0x586a348) returned 0x0
	[0181.547] CoGetContextToken (in: pToken=0x586a348 | out: pToken=0x586a348) returned 0x0
	[0181.547] CoGetContextToken (in: pToken=0x586a348 | out: pToken=0x586a348) returned 0x0
	[0181.553] CoGetContextToken (in: pToken=0x586b3a4 | out: pToken=0x586b3a4) returned 0x0
	[0181.553] CoGetContextToken (in: pToken=0x586b974 | out: pToken=0x586b974) returned 0x0
	[0181.553] CoGetContextToken (in: pToken=0x586b8d4 | out: pToken=0x586b8d4) returned 0x0
	[0181.553] CoGetContextToken (in: pToken=0x586ba04 | out: pToken=0x586ba04) returned 0x0
	[0181.567] CoGetContextToken (in: pToken=0x586af8c | out: pToken=0x586af8c) returned 0x0
	[0181.567] CoGetContextToken (in: pToken=0x586b39c | out: pToken=0x586b39c) returned 0x0
	[0181.567] CoGetContextToken (in: pToken=0x586b96c | out: pToken=0x586b96c) returned 0x0
	[0181.567] CoGetContextToken (in: pToken=0x586b8cc | out: pToken=0x586b8cc) returned 0x0
	[0181.568] CoGetContextToken (in: pToken=0x586af84 | out: pToken=0x586af84) returned 0x0
	[0181.568] CoGetContextToken (in: pToken=0x586b394 | out: pToken=0x586b394) returned 0x0
	[0181.568] CoGetContextToken (in: pToken=0x586b964 | out: pToken=0x586b964) returned 0x0
	[0181.568] CoGetContextToken (in: pToken=0x586b8c4 | out: pToken=0x586b8c4) returned 0x0
	[0181.764] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", nBufferLength=0x105, lpBuffer=0x586b7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", lpFilePart=0x0) returned 0x9a
	[0181.764] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", nBufferLength=0x105, lpBuffer=0x586b694, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", lpFilePart=0x0) returned 0x9a
	[0181.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0181.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0181.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586df6c) returned 1
	[0181.875] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2b5decc | out: lpFileInformation=0x2b5decc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88a4ec5, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0xd88a4ec5, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x91837f7c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x5198)) returned 1
	[0181.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586df68) returned 1
	[0181.876] EtwEventActivityIdControl () returned 0x0
	[0181.876] SetEvent (hEvent=0x474) returned 1
	[0181.876] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x586e74c*=0x474, lpdwindex=0x586e570 | out: lpdwindex=0x586e570) returned 0x0
	[0181.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60
	[0181.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x358ee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f
	[0181.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x586e62c) returned 1
	[0181.877] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2b5ee2c | out: lpFileInformation=0x2b5ee2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88a4ec5, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0xd88a4ec5, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x91837f7c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x5198)) returned 1
	[0181.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x586e628) returned 1
	[0181.881] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10
	[0181.883] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e8e0 | out: lpConsoleScreenBufferInfo=0x586e8e0) returned 1
	[0181.884] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e8e0 | out: lpConsoleScreenBufferInfo=0x586e8e0) returned 1
	[0181.887] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5b50078*=0x3ec, lpdwindex=0x586e754 | out: lpdwindex=0x586e754) returned 0x0
	[0181.898] CoGetContextToken (in: pToken=0x586dcc8 | out: pToken=0x586dcc8) returned 0x0
	[0181.899] CoGetContextToken (in: pToken=0x586dcac | out: pToken=0x586dcac) returned 0x0
	[0181.899] CoGetContextToken (in: pToken=0x586dc30 | out: pToken=0x586dc30) returned 0x0
	[0181.899] CoGetContextToken (in: pToken=0x586dc30 | out: pToken=0x586dc30) returned 0x0
	[0181.899] CoGetContextToken (in: pToken=0x586dc30 | out: pToken=0x586dc30) returned 0x0
	[0182.519] EtwEventActivityIdControl () returned 0x0
	[0182.519] EtwEventActivityIdControl () returned 0x0
	[0182.519] EtwEventActivityIdControl () returned 0x0
	[0182.529] EtwEventActivityIdControl () returned 0x0
	[0182.529] EtwEventActivityIdControl () returned 0x0
	[0182.529] EtwEventActivityIdControl () returned 0x0
	[0182.551] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x2cbd38
	[0182.555] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x2cb4b8
	[0182.572] CoCreateGuid (in: pguid=0x586e6a4 | out: pguid=0x586e6a4*(Data1=0xe022abe7, Data2=0x7742, Data3=0x43e8, Data4=([0]=0xa2, [1]=0x11, [2]=0xa7, [3]=0x57, [4]=0x54, [5]=0x90, [6]=0xe2, [7]=0x23))) returned 0x0
	[0182.580] QueryPerformanceCounter (in: lpPerformanceCount=0x586e3f0 | out: lpPerformanceCount=0x586e3f0*=2532679231184) returned 1
	[0183.367] CoCreateGuid (in: pguid=0x586e6a4 | out: pguid=0x586e6a4*(Data1=0x20112abd, Data2=0x17e, Data3=0x406a, Data4=([0]=0x82, [1]=0xd8, [2]=0x0, [3]=0x60, [4]=0xc0, [5]=0xda, [6]=0x5c, [7]=0x25))) returned 0x0
	[0183.372] QueryPerformanceCounter (in: lpPerformanceCount=0x586e3f0 | out: lpPerformanceCount=0x586e3f0*=2532758394489) returned 1
	[0184.143] CoCreateGuid (in: pguid=0x586e248 | out: pguid=0x586e248*(Data1=0xbadcf3d0, Data2=0x74ed, Data3=0x42e3, Data4=([0]=0xbc, [1]=0x87, [2]=0x8b, [3]=0x42, [4]=0xa1, [5]=0x75, [6]=0xa1, [7]=0xc8))) returned 0x0
	[0184.144] QueryPerformanceCounter (in: lpPerformanceCount=0x586e084 | out: lpPerformanceCount=0x586e084*=2532835646369) returned 1
	[0184.152] QueryPerformanceCounter (in: lpPerformanceCount=0x586e04c | out: lpPerformanceCount=0x586e04c*=2532836401509) returned 1
	[0184.152] EtwEventActivityIdControl () returned 0x0
	[0184.152] EtwEventActivityIdControl () returned 0x0
	[0184.152] EtwEventActivityIdControl () returned 0x0
	[0184.153] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x586dab8, nSize=0xcf | out: lpBuffer="") returned 0x0
	[0184.171] EtwEventActivityIdControl () returned 0x0
	[0184.171] EtwEventActivityIdControl () returned 0x0
	[0184.171] EtwEventActivityIdControl () returned 0x0
	[0184.172] EtwEventActivityIdControl () returned 0x0
	[0184.247] QueryPerformanceCounter (in: lpPerformanceCount=0x586dc08 | out: lpPerformanceCount=0x586dc08*=2532845968735) returned 1
	[0184.249] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x464
	[0184.249] CoCreateGuid (in: pguid=0x586db10 | out: pguid=0x586db10*(Data1=0xf3837aa8, Data2=0x11b2, Data3=0x4bed, Data4=([0]=0xaa, [1]=0x86, [2]=0xb3, [3]=0xd4, [4]=0xd5, [5]=0x52, [6]=0x9f, [7]=0xeb))) returned 0x0
	[0184.250] QueryPerformanceCounter (in: lpPerformanceCount=0x586d94c | out: lpPerformanceCount=0x586d94c*=2532846208691) returned 1
	[0184.263] QueryPerformanceCounter (in: lpPerformanceCount=0x586d914 | out: lpPerformanceCount=0x586d914*=2532847514618) returned 1
	[0184.263] EtwEventActivityIdControl () returned 0x0
	[0184.263] EtwEventActivityIdControl () returned 0x0
	[0184.263] EtwEventActivityIdControl () returned 0x0
	[0184.264] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x586d380, nSize=0xcf | out: lpBuffer="") returned 0x0
	[0184.264] EtwEventActivityIdControl () returned 0x0
	[0184.264] EtwEventActivityIdControl () returned 0x0
	[0184.264] EtwEventActivityIdControl () returned 0x0
	[0184.265] EtwEventActivityIdControl () returned 0x0
	[0184.489] EtwEventActivityIdControl () returned 0x0
	[0184.489] EtwEventActivityIdControl () returned 0x0
	[0184.489] EtwEventActivityIdControl () returned 0x0
	[0184.489] EtwEventActivityIdControl () returned 0x0
	[0184.744] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e224 | out: lpConsoleScreenBufferInfo=0x586e224) returned 1
	[0184.983] CoCreateGuid (in: pguid=0x586e248 | out: pguid=0x586e248*(Data1=0x23b8d70e, Data2=0xe497, Data3=0x43ad, Data4=([0]=0xa7, [1]=0xcd, [2]=0xaf, [3]=0xc2, [4]=0xd6, [5]=0x8, [6]=0x13, [7]=0xf7))) returned 0x0
	[0184.983] QueryPerformanceCounter (in: lpPerformanceCount=0x586e084 | out: lpPerformanceCount=0x586e084*=2532919576706) returned 1
	[0184.990] QueryPerformanceCounter (in: lpPerformanceCount=0x586e04c | out: lpPerformanceCount=0x586e04c*=2532920221008) returned 1
	[0184.990] EtwEventActivityIdControl () returned 0x0
	[0184.990] EtwEventActivityIdControl () returned 0x0
	[0184.991] EtwEventActivityIdControl () returned 0x0
	[0184.992] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x586dab8, nSize=0xcf | out: lpBuffer="") returned 0x0
	[0184.993] EtwEventActivityIdControl () returned 0x0
	[0184.993] EtwEventActivityIdControl () returned 0x0
	[0184.993] EtwEventActivityIdControl () returned 0x0
	[0184.994] EtwEventActivityIdControl () returned 0x0
	[0185.065] EtwEventActivityIdControl () returned 0x0
	[0185.065] EtwEventActivityIdControl () returned 0x0
	[0185.367] CoCreateGuid (in: pguid=0x586e248 | out: pguid=0x586e248*(Data1=0xe28628e6, Data2=0x459b, Data3=0x40fc, Data4=([0]=0x94, [1]=0x4a, [2]=0xc3, [3]=0xe0, [4]=0x73, [5]=0x8f, [6]=0x7d, [7]=0xc4))) returned 0x0
	[0185.367] QueryPerformanceCounter (in: lpPerformanceCount=0x586e084 | out: lpPerformanceCount=0x586e084*=2532957968206) returned 1
	[0185.372] QueryPerformanceCounter (in: lpPerformanceCount=0x586e04c | out: lpPerformanceCount=0x586e04c*=2532958415035) returned 1
	[0185.372] EtwEventActivityIdControl () returned 0x0
	[0185.372] EtwEventActivityIdControl () returned 0x0
	[0185.372] EtwEventActivityIdControl () returned 0x0
	[0185.373] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x586dab8, nSize=0xcf | out: lpBuffer="") returned 0x0
	[0185.373] EtwEventActivityIdControl () returned 0x0
	[0185.373] EtwEventActivityIdControl () returned 0x0
	[0185.373] EtwEventActivityIdControl () returned 0x0
	[0185.374] EtwEventActivityIdControl () returned 0x0
	[0185.424] EtwEventActivityIdControl () returned 0x0
	[0185.424] EtwEventActivityIdControl () returned 0x0
	[0185.566] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e874 | out: lpConsoleScreenBufferInfo=0x586e874) returned 1
	[0185.572] GetConsoleOutputCP () returned 0x1b5
	[0185.573] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.574] GetConsoleOutputCP () returned 0x1b5
	[0185.575] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.575] GetConsoleOutputCP () returned 0x1b5
	[0185.575] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.575] GetConsoleOutputCP () returned 0x1b5
	[0185.575] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.576] GetConsoleOutputCP () returned 0x1b5
	[0185.576] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.576] GetConsoleOutputCP () returned 0x1b5
	[0185.576] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.576] GetConsoleOutputCP () returned 0x1b5
	[0185.576] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.576] GetConsoleOutputCP () returned 0x1b5
	[0185.577] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.577] GetConsoleOutputCP () returned 0x1b5
	[0185.577] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.577] GetConsoleOutputCP () returned 0x1b5
	[0185.577] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.577] GetConsoleOutputCP () returned 0x1b5
	[0185.578] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.578] GetConsoleOutputCP () returned 0x1b5
	[0185.578] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.578] GetConsoleOutputCP () returned 0x1b5
	[0185.578] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.578] GetConsoleOutputCP () returned 0x1b5
	[0185.578] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.578] GetConsoleOutputCP () returned 0x1b5
	[0185.579] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.579] GetConsoleOutputCP () returned 0x1b5
	[0185.579] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.579] GetConsoleOutputCP () returned 0x1b5
	[0185.579] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.579] GetConsoleOutputCP () returned 0x1b5
	[0185.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.580] GetConsoleOutputCP () returned 0x1b5
	[0185.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.580] GetConsoleOutputCP () returned 0x1b5
	[0185.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.580] GetConsoleOutputCP () returned 0x1b5
	[0185.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.580] GetConsoleOutputCP () returned 0x1b5
	[0185.581] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.581] GetConsoleOutputCP () returned 0x1b5
	[0185.581] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.581] GetConsoleOutputCP () returned 0x1b5
	[0185.581] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.581] GetConsoleOutputCP () returned 0x1b5
	[0185.582] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.582] GetConsoleOutputCP () returned 0x1b5
	[0185.582] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.582] GetConsoleOutputCP () returned 0x1b5
	[0185.582] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.582] GetConsoleOutputCP () returned 0x1b5
	[0185.582] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.583] GetConsoleOutputCP () returned 0x1b5
	[0185.583] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.583] GetConsoleOutputCP () returned 0x1b5
	[0185.583] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.583] GetConsoleOutputCP () returned 0x1b5
	[0185.583] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.583] GetConsoleOutputCP () returned 0x1b5
	[0185.584] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.584] GetConsoleOutputCP () returned 0x1b5
	[0185.584] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.584] GetConsoleOutputCP () returned 0x1b5
	[0185.584] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.584] GetConsoleOutputCP () returned 0x1b5
	[0185.584] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.584] GetConsoleOutputCP () returned 0x1b5
	[0185.585] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.585] GetConsoleOutputCP () returned 0x1b5
	[0185.585] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.585] GetConsoleOutputCP () returned 0x1b5
	[0185.585] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.585] GetConsoleOutputCP () returned 0x1b5
	[0185.585] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.586] GetConsoleOutputCP () returned 0x1b5
	[0185.586] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0185.586] GetConsoleOutputCP () returned 0x1b5
	[0186.638] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.639] GetConsoleOutputCP () returned 0x1b5
	[0186.640] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.641] GetConsoleOutputCP () returned 0x1b5
	[0186.641] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.641] GetConsoleOutputCP () returned 0x1b5
	[0186.641] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.641] GetConsoleOutputCP () returned 0x1b5
	[0186.641] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.642] GetConsoleOutputCP () returned 0x1b5
	[0186.642] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.642] GetConsoleOutputCP () returned 0x1b5
	[0186.642] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.642] GetConsoleOutputCP () returned 0x1b5
	[0186.642] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.642] GetConsoleOutputCP () returned 0x1b5
	[0186.643] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.643] GetConsoleOutputCP () returned 0x1b5
	[0186.643] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.643] GetConsoleOutputCP () returned 0x1b5
	[0186.643] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.643] GetConsoleOutputCP () returned 0x1b5
	[0186.643] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.643] GetConsoleOutputCP () returned 0x1b5
	[0186.644] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.644] GetConsoleOutputCP () returned 0x1b5
	[0186.644] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.644] GetConsoleOutputCP () returned 0x1b5
	[0186.644] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.644] GetConsoleOutputCP () returned 0x1b5
	[0186.644] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.644] GetConsoleOutputCP () returned 0x1b5
	[0186.645] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.645] GetConsoleOutputCP () returned 0x1b5
	[0186.645] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.645] GetConsoleOutputCP () returned 0x1b5
	[0186.645] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.645] GetConsoleOutputCP () returned 0x1b5
	[0186.646] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.646] GetConsoleOutputCP () returned 0x1b5
	[0186.646] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.646] GetConsoleOutputCP () returned 0x1b5
	[0186.646] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.646] GetConsoleOutputCP () returned 0x1b5
	[0186.646] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.647] GetConsoleOutputCP () returned 0x1b5
	[0186.647] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.647] GetConsoleOutputCP () returned 0x1b5
	[0186.647] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.647] GetConsoleOutputCP () returned 0x1b5
	[0186.647] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.647] GetConsoleOutputCP () returned 0x1b5
	[0186.648] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.648] GetConsoleOutputCP () returned 0x1b5
	[0186.648] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.648] GetConsoleOutputCP () returned 0x1b5
	[0186.648] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.648] GetConsoleOutputCP () returned 0x1b5
	[0186.648] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.648] GetConsoleOutputCP () returned 0x1b5
	[0186.649] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.649] GetConsoleOutputCP () returned 0x1b5
	[0186.649] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x586e6ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x586e6ec) returned 0
	[0186.651] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.653] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.653] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.654] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.655] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.656] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.657] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.659] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x586ddd8, nSize=0xcf | out: lpBuffer="") returned 0x0
	[0186.659] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.660] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b96ea4*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b96ea4*, lpNumberOfCharsWritten=0x586e77c*=0x4d) returned 1
	[0186.664] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.664] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.664] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.665] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.665] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.665] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.666] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.666] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.666] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.667] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.667] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.667] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.668] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.668] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.668] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b974c0*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b974c0*, lpNumberOfCharsWritten=0x586e77c*=0x4f) returned 1
	[0186.669] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.669] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.671] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.671] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.671] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.672] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.672] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.672] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.673] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.673] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.673] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.674] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.674] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.675] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.675] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b97a40*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b97a40*, lpNumberOfCharsWritten=0x586e77c*=0x4d) returned 1
	[0186.675] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.676] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.676] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.677] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.677] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.677] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.678] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.678] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.678] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.679] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.679] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.679] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.680] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.680] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.680] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b97ae8*, nNumberOfCharsToWrite=0x6, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b97ae8*, lpNumberOfCharsWritten=0x586e77c*=0x6) returned 1
	[0186.681] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.681] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.681] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.682] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.682] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.682] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.683] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.683] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.683] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.684] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.684] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.684] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.685] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.686] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.686] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b96570*, nNumberOfCharsToWrite=0x10, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b96570*, lpNumberOfCharsWritten=0x586e77c*=0x10) returned 1
	[0186.687] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.687] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.687] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.688] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.688] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.688] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.689] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.690] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.690] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.690] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.691] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.691] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.691] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.691] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.692] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b965a0*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b965a0*, lpNumberOfCharsWritten=0x586e77c*=0x4b) returned 1
	[0186.692] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.693] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.693] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.694] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.694] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.703] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.703] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.703] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.704] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.704] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.704] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.705] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.705] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.705] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.706] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b96644*, nNumberOfCharsToWrite=0x12, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b96644*, lpNumberOfCharsWritten=0x586e77c*=0x12) returned 1
	[0186.706] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.707] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.707] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.708] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.708] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.708] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.709] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.709] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.709] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.710] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.710] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.711] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.711] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.711] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.712] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b98240*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b98240*, lpNumberOfCharsWritten=0x586e77c*=0x4f) returned 1
	[0186.712] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.713] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.713] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.713] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.714] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.714] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.714] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.715] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.715] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.715] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.716] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.716] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.716] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.717] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.717] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b98484*, nNumberOfCharsToWrite=0x19, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b98484*, lpNumberOfCharsWritten=0x586e77c*=0x19) returned 1
	[0186.717] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.718] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.718] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.718] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.719] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.719] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.719] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.720] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.720] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.720] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.721] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.721] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.721] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.722] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.722] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b96758*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b96758*, lpNumberOfCharsWritten=0x586e77c*=0x36) returned 1
	[0186.723] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.723] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.723] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.724] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.724] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.725] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.725] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e7cc | out: lpConsoleScreenBufferInfo=0x586e7cc) returned 1
	[0186.725] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.726] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e764 | out: lpConsoleScreenBufferInfo=0x586e764) returned 1
	[0186.726] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.727] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.727] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e76c | out: lpConsoleScreenBufferInfo=0x586e76c) returned 1
	[0186.727] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1
	[0186.728] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e788 | out: lpMode=0x586e788) returned 1
	[0186.728] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2b967d4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e77c, lpReserved=0x0 | out: lpBuffer=0x2b967d4*, lpNumberOfCharsWritten=0x586e77c*=0x1) returned 1
	[0186.729] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.729] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.729] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x586e768 | out: lpConsoleScreenBufferInfo=0x586e768) returned 1
	[0186.730] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1
	[0186.730] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x586e7c8 | out: lpMode=0x586e7c8) returned 1
	[0186.730] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2860594*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x586e7bc, lpReserved=0x0 | out: lpBuffer=0x2860594*, lpNumberOfCharsWritten=0x586e7bc*=0x1) returned 1
	[0186.732] EtwEventActivityIdControl () returned 0x0
	[0186.732] EtwEventActivityIdControl () returned 0x0
	[0186.734] EtwEventActivityIdControl () returned 0x0
	[0186.734] EtwEventActivityIdControl () returned 0x0
	[0186.734] EtwEventActivityIdControl () returned 0x0
	[0186.734] EtwEventActivityIdControl () returned 0x0
	[0186.735] EtwEventActivityIdControl () returned 0x0
	[0186.735] EtwEventActivityIdControl () returned 0x0
	[0186.739] SetEvent (hEvent=0x348) returned 1
	[0186.739] SetEvent (hEvent=0x33c) returned 1
	[0186.739] SetEvent (hEvent=0x340) returned 1
	[0186.739] SetEvent (hEvent=0x344) returned 1
	[0186.739] SetEvent (hEvent=0x358) returned 1
	[0186.739] SetEvent (hEvent=0x34c) returned 1
	[0186.739] SetEvent (hEvent=0x350) returned 1
	[0186.740] SetEvent (hEvent=0x354) returned 1
	[0186.740] SetEvent (hEvent=0x35c) returned 1
	[0186.740] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x586f040*=0x364, lpdwindex=0x586ee64 | out: lpdwindex=0x586ee64) returned 0x0
	[0186.748] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0186.751] CoCreateGuid (in: pguid=0x586eeac | out: pguid=0x586eeac*(Data1=0xe88e3004, Data2=0x12b0, Data3=0x4325, Data4=([0]=0xa3, [1]=0x96, [2]=0x38, [3]=0xa, [4]=0xc9, [5]=0x3, [6]=0x2e, [7]=0xdb))) returned 0x0
	[0186.752] QueryPerformanceCounter (in: lpPerformanceCount=0x586ee8c | out: lpPerformanceCount=0x586ee8c*=2533096382686) returned 1
	[0186.759] QueryPerformanceCounter (in: lpPerformanceCount=0x586ee54 | out: lpPerformanceCount=0x586ee54*=2533097100806) returned 1
	[0186.759] EtwEventActivityIdControl () returned 0x0
	[0186.759] EtwEventActivityIdControl () returned 0x0
	[0186.759] EtwEventActivityIdControl () returned 0x0
	[0186.761] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x586ea00*=0x450, lpdwindex=0x586e8c4 | out: lpdwindex=0x586e8c4) returned 0x0
	[0186.762] SetEvent (hEvent=0x458) returned 1
	[0186.762] SetEvent (hEvent=0x450) returned 1
	[0186.762] EtwEventActivityIdControl () returned 0x0
	[0186.762] SetEvent (hEvent=0x61c) returned 1
	[0186.763] SetEvent (hEvent=0x458) returned 1
	[0186.763] SetEvent (hEvent=0x450) returned 1
	[0186.763] SetEvent (hEvent=0x610) returned 1
	[0186.763] SetEvent (hEvent=0x60c) returned 1
	[0186.765] SetEvent (hEvent=0x620) returned 1
	[0186.765] SetEvent (hEvent=0x624) returned 1
	[0186.765] SetEvent (hEvent=0x628) returned 1
	[0186.777] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x586f040*=0x364, lpdwindex=0x586ee64 | out: lpdwindex=0x586ee64) returned 0x0
	[0187.212] CoGetContextToken (in: pToken=0x586f42c | out: pToken=0x586f42c) returned 0x0
	[0187.213] CoUninitialize () 

Thread:
	id = 106
	os_tid = 0xadc


Thread:
	id = 107
	os_tid = 0xb14


Thread:
	id = 108
	os_tid = 0xb0c


Thread:
	id = 109
	os_tid = 0xb18


Thread:
	id = 110
	os_tid = 0x414

	[0172.652] CoGetContextToken (in: pToken=0x5c9f794 | out: pToken=0x5c9f794) returned 0x0
	[0172.652] CObjectContext::QueryInterface () returned 0x0
	[0172.652] CObjectContext::GetCurrentThreadType () returned 0x0
	[0172.652] Release () returned 0x0
	[0172.653] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0

Thread:
	id = 111
	os_tid = 0xcf8


Thread:
	id = 112
	os_tid = 0xcf4

	[0181.889] CoGetContextToken (in: pToken=0x5cdf0b4 | out: pToken=0x5cdf0b4) returned 0x0
	[0181.889] IUnknown:QueryInterface (in: This=0x2b0af0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5cdf0d8 | out: ppvObject=0x5cdf0d8*=0x2b0afc) returned 0x0
	[0181.890] IComThreadingInfo:GetCurrentThreadType (in: This=0x2b0afc, pThreadType=0x5cdf104 | out: pThreadType=0x5cdf104*=0) returned 0x0
	[0181.890] IUnknown:Release (This=0x2b0afc) returned 0x0
	[0181.900] CoGetContextToken (in: pToken=0x5cdf0b4 | out: pToken=0x5cdf0b4) returned 0x0
	[0181.900] IUnknown:QueryInterface (in: This=0x2b0af0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5cdf0d8 | out: ppvObject=0x5cdf0d8*=0x2b0afc) returned 0x0
	[0181.900] IComThreadingInfo:GetCurrentThreadType (in: This=0x2b0afc, pThreadType=0x5cdf104 | out: pThreadType=0x5cdf104*=0) returned 0x0
	[0181.900] IUnknown:Release (This=0x2b0afc) returned 0x0

Thread:
	id = 113
	os_tid = 0xcec


Thread:
	id = 114
	os_tid = 0x32c


Process:
	id = "3"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x76036000"
	os_pid = "0x364"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "rpc_server"
	parent_id = "1"
	os_parent_pid = "0x1c0"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d1f9" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 1574
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1575
	        start_va = 0x20000
	          end_va = 0x20fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 1576
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1577
	        start_va = 0x40000
	          end_va = 0x40fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1578
	        start_va = 0x50000
	          end_va = 0xb6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1579
	        start_va = 0xc0000
	          end_va = 0xc0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000c0000"
	        filename = ""

Region:
	              id = 1580
	        start_va = 0xd0000
	          end_va = 0xd0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000d0000"
	        filename = ""

Region:
	              id = 1581
	        start_va = 0xe0000
	          end_va = 0xe0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1582
	        start_va = 0xf0000
	          end_va = 0x16ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1583
	        start_va = 0x170000
	          end_va = 0x22ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 1584
	        start_va = 0x230000
	          end_va = 0x32ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 1585
	        start_va = 0x330000
	          end_va = 0x330fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000330000"
	        filename = ""

Region:
	              id = 1586
	        start_va = 0x340000
	          end_va = 0x340fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000340000"
	        filename = ""

Region:
	              id = 1587
	        start_va = 0x350000
	          end_va = 0x35afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "gpsvc.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui")

Region:
	              id = 1588
	        start_va = 0x360000
	          end_va = 0x36cfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "setupapi.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui")

Region:
	              id = 1589
	        start_va = 0x370000
	          end_va = 0x3effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000370000"
	        filename = ""

Region:
	              id = 1590
	        start_va = 0x3f0000
	          end_va = 0x3f3fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskcomp.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\taskcomp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskcomp.dll.mui")

Region:
	              id = 1591
	        start_va = 0x400000
	          end_va = 0x40ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1592
	        start_va = 0x410000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000410000"
	        filename = ""

Region:
	              id = 1593
	        start_va = 0x510000
	          end_va = 0x697fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000510000"
	        filename = ""

Region:
	              id = 1594
	        start_va = 0x6a0000
	          end_va = 0x820fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006a0000"
	        filename = ""

Region:
	              id = 1595
	        start_va = 0x830000
	          end_va = 0x839fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "schedsvc.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\schedsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\schedsvc.dll.mui")

Region:
	              id = 1596
	        start_va = 0x840000
	          end_va = 0x841fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000840000"
	        filename = ""

Region:
	              id = 1597
	        start_va = 0x850000
	          end_va = 0x8cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000850000"
	        filename = ""

Region:
	              id = 1598
	        start_va = 0x8d0000
	          end_va = 0x8d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msxml3r.dll"
	        filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll")

Region:
	              id = 1599
	        start_va = 0x8e0000
	          end_va = 0x8fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008e0000"
	        filename = ""

Region:
	              id = 1600
	        start_va = 0x900000
	          end_va = 0x90ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 1601
	        start_va = 0x910000
	          end_va = 0x912fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wuaueng.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui")

Region:
	              id = 1602
	        start_va = 0x950000
	          end_va = 0x953fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1603
	        start_va = 0x960000
	          end_va = 0x9dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000960000"
	        filename = ""

Region:
	              id = 1604
	        start_va = 0xa60000
	          end_va = 0xa60fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000a60000"
	        filename = ""

Region:
	              id = 1605
	        start_va = 0xa70000
	          end_va = 0xa71fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a70000"
	        filename = ""

Region:
	              id = 1606
	        start_va = 0xa80000
	          end_va = 0xaaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db")

Region:
	              id = 1607
	        start_va = 0xab0000
	          end_va = 0xb2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ab0000"
	        filename = ""

Region:
	              id = 1608
	        start_va = 0xb30000
	          end_va = 0xb33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 1609
	        start_va = 0xb40000
	          end_va = 0xb4dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "propsys.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui")

Region:
	              id = 1610
	        start_va = 0xb50000
	          end_va = 0xb57fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "vsstrace.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui")

Region:
	              id = 1611
	        start_va = 0xb60000
	          end_va = 0xb60fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b60000"
	        filename = ""

Region:
	              id = 1612
	        start_va = 0xb70000
	          end_va = 0xb70fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wshtcpip.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui")

Region:
	              id = 1613
	        start_va = 0xb80000
	          end_va = 0xb80fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wship6.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui")

Region:
	              id = 1614
	        start_va = 0xb90000
	          end_va = 0xb90fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b90000"
	        filename = ""

Region:
	              id = 1615
	        start_va = 0xba0000
	          end_va = 0xba0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ba0000"
	        filename = ""

Region:
	              id = 1616
	        start_va = 0xbb0000
	          end_va = 0xbb0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000bb0000"
	        filename = ""

Region:
	              id = 1617
	        start_va = 0xbf0000
	          end_va = 0xebefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1618
	        start_va = 0xec0000
	          end_va = 0xf25fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")

Region:
	              id = 1619
	        start_va = 0xf30000
	          end_va = 0xf4bfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "firewallapi.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui")

Region:
	              id = 1620
	        start_va = 0xf50000
	          end_va = 0xf50fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000f50000"
	        filename = ""

Region:
	              id = 1621
	        start_va = 0xf60000
	          end_va = 0xf60fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f60000"
	        filename = ""

Region:
	              id = 1622
	        start_va = 0xf70000
	          end_va = 0xf89fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f70000"
	        filename = ""

Region:
	              id = 1623
	        start_va = 0xf90000
	          end_va = 0xf9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000f90000"
	        filename = ""

Region:
	              id = 1624
	        start_va = 0xfa0000
	          end_va = 0xfaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fa0000"
	        filename = ""

Region:
	              id = 1625
	        start_va = 0xfb0000
	          end_va = 0xfbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fb0000"
	        filename = ""

Region:
	              id = 1626
	        start_va = 0xfc0000
	          end_va = 0xfcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fc0000"
	        filename = ""

Region:
	              id = 1627
	        start_va = 0xfd0000
	          end_va = 0xfdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fd0000"
	        filename = ""

Region:
	              id = 1628
	        start_va = 0xfe0000
	          end_va = 0xfeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 1629
	        start_va = 0xff0000
	          end_va = 0xff0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 1630
	        start_va = 0x1000000
	          end_va = 0x1007fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001000000"
	        filename = ""

Region:
	              id = 1631
	        start_va = 0x1010000
	          end_va = 0x101ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001010000"
	        filename = ""

Region:
	              id = 1632
	        start_va = 0x1020000
	          end_va = 0x109ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001020000"
	        filename = ""

Region:
	              id = 1633
	        start_va = 0x10a0000
	          end_va = 0x10affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010a0000"
	        filename = ""

Region:
	              id = 1634
	        start_va = 0x10b0000
	          end_va = 0x10bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010b0000"
	        filename = ""

Region:
	              id = 1635
	        start_va = 0x10c0000
	          end_va = 0x113ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000010c0000"
	        filename = ""

Region:
	              id = 1636
	        start_va = 0x1140000
	          end_va = 0x114ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001140000"
	        filename = ""

Region:
	              id = 1637
	        start_va = 0x1150000
	          end_va = 0x115ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001150000"
	        filename = ""

Region:
	              id = 1638
	        start_va = 0x1160000
	          end_va = 0x116ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001160000"
	        filename = ""

Region:
	              id = 1639
	        start_va = 0x1170000
	          end_va = 0x117ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001170000"
	        filename = ""

Region:
	              id = 1640
	        start_va = 0x1180000
	          end_va = 0x118ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001180000"
	        filename = ""

Region:
	              id = 1641
	        start_va = 0x1190000
	          end_va = 0x119ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001190000"
	        filename = ""

Region:
	              id = 1642
	        start_va = 0x11a0000
	          end_va = 0x11a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011a0000"
	        filename = ""

Region:
	              id = 1643
	        start_va = 0x11b0000
	          end_va = 0x11b1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011b0000"
	        filename = ""

Region:
	              id = 1644
	        start_va = 0x11c0000
	          end_va = 0x11c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011c0000"
	        filename = ""

Region:
	              id = 1645
	        start_va = 0x11d0000
	          end_va = 0x11dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011d0000"
	        filename = ""

Region:
	              id = 1646
	        start_va = 0x11e0000
	          end_va = 0x11effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011e0000"
	        filename = ""

Region:
	              id = 1647
	        start_va = 0x11f0000
	          end_va = 0x126ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011f0000"
	        filename = ""

Region:
	              id = 1648
	        start_va = 0x1270000
	          end_va = 0x1277fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001270000"
	        filename = ""

Region:
	              id = 1649
	        start_va = 0x1280000
	          end_va = 0x128ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001280000"
	        filename = ""

Region:
	              id = 1650
	        start_va = 0x1290000
	          end_va = 0x129ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001290000"
	        filename = ""

Region:
	              id = 1651
	        start_va = 0x12a0000
	          end_va = 0x12a7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000012a0000"
	        filename = ""

Region:
	              id = 1652
	        start_va = 0x12c0000
	          end_va = 0x133ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000012c0000"
	        filename = ""

Region:
	              id = 1653
	        start_va = 0x1340000
	          end_va = 0x134ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 1654
	        start_va = 0x1350000
	          end_va = 0x135ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001350000"
	        filename = ""

Region:
	              id = 1655
	        start_va = 0x1360000
	          end_va = 0x136ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001360000"
	        filename = ""

Region:
	              id = 1656
	        start_va = 0x1370000
	          end_va = 0x137ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001370000"
	        filename = ""

Region:
	              id = 1657
	        start_va = 0x1380000
	          end_va = 0x1387fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001380000"
	        filename = ""

Region:
	              id = 1658
	        start_va = 0x1390000
	          end_va = 0x139ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001390000"
	        filename = ""

Region:
	              id = 1659
	        start_va = 0x13a0000
	          end_va = 0x141ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000013a0000"
	        filename = ""

Region:
	              id = 1660
	        start_va = 0x1480000
	          end_va = 0x148ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001480000"
	        filename = ""

Region:
	              id = 1661
	        start_va = 0x1490000
	          end_va = 0x14cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001490000"
	        filename = ""

Region:
	              id = 1662
	        start_va = 0x14d0000
	          end_va = 0x150ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000014d0000"
	        filename = ""

Region:
	              id = 1663
	        start_va = 0x1530000
	          end_va = 0x15affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001530000"
	        filename = ""

Region:
	              id = 1664
	        start_va = 0x15f0000
	          end_va = 0x166ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000015f0000"
	        filename = ""

Region:
	              id = 1665
	        start_va = 0x16b0000
	          end_va = 0x172ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000016b0000"
	        filename = ""

Region:
	              id = 1666
	        start_va = 0x1750000
	          end_va = 0x17cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001750000"
	        filename = ""

Region:
	              id = 1667
	        start_va = 0x1850000
	          end_va = 0x18cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001850000"
	        filename = ""

Region:
	              id = 1668
	        start_va = 0x18e0000
	          end_va = 0x195ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000018e0000"
	        filename = ""

Region:
	              id = 1669
	        start_va = 0x1980000
	          end_va = 0x19fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001980000"
	        filename = ""

Region:
	              id = 1670
	        start_va = 0x1a70000
	          end_va = 0x1aeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a70000"
	        filename = ""

Region:
	              id = 1671
	        start_va = 0x1af0000
	          end_va = 0x1beffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001af0000"
	        filename = ""

Region:
	              id = 1672
	        start_va = 0x1bf0000
	          end_va = 0x1c6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001bf0000"
	        filename = ""

Region:
	              id = 1673
	        start_va = 0x1c80000
	          end_va = 0x1d7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001c80000"
	        filename = ""

Region:
	              id = 1674
	        start_va = 0x1db0000
	          end_va = 0x1e2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001db0000"
	        filename = ""

Region:
	              id = 1675
	        start_va = 0x1e30000
	          end_va = 0x1eaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001e30000"
	        filename = ""

Region:
	              id = 1676
	        start_va = 0x1eb0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001eb0000"
	        filename = ""

Region:
	              id = 1677
	        start_va = 0x1fb0000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fb0000"
	        filename = ""

Region:
	              id = 1678
	        start_va = 0x2050000
	          end_va = 0x20cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002050000"
	        filename = ""

Region:
	              id = 1679
	        start_va = 0x2130000
	          end_va = 0x21affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002130000"
	        filename = ""

Region:
	              id = 1680
	        start_va = 0x21c0000
	          end_va = 0x223ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021c0000"
	        filename = ""

Region:
	              id = 1681
	        start_va = 0x22b0000
	          end_va = 0x232ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000022b0000"
	        filename = ""

Region:
	              id = 1682
	        start_va = 0x2330000
	          end_va = 0x242ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002330000"
	        filename = ""

Region:
	              id = 1683
	        start_va = 0x24b0000
	          end_va = 0x25affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000024b0000"
	        filename = ""

Region:
	              id = 1684
	        start_va = 0x25b0000
	          end_va = 0x262ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000025b0000"
	        filename = ""

Region:
	              id = 1685
	        start_va = 0x26a0000
	          end_va = 0x279ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000026a0000"
	        filename = ""

Region:
	              id = 1686
	        start_va = 0x2840000
	          end_va = 0x28bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002840000"
	        filename = ""

Region:
	              id = 1687
	        start_va = 0x28c0000
	          end_va = 0x29bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000028c0000"
	        filename = ""

Region:
	              id = 1688
	        start_va = 0x29c0000
	          end_va = 0x29cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029c0000"
	        filename = ""

Region:
	              id = 1689
	        start_va = 0x29d0000
	          end_va = 0x2a4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029d0000"
	        filename = ""

Region:
	              id = 1690
	        start_va = 0x2a70000
	          end_va = 0x2a7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a70000"
	        filename = ""

Region:
	              id = 1691
	        start_va = 0x2aa0000
	          end_va = 0x2b1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002aa0000"
	        filename = ""

Region:
	              id = 1692
	        start_va = 0x2bf0000
	          end_va = 0x2c6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bf0000"
	        filename = ""

Region:
	              id = 1693
	        start_va = 0x2c70000
	          end_va = 0x2ceffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c70000"
	        filename = ""

Region:
	              id = 1694
	        start_va = 0x2cf0000
	          end_va = 0x2deffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002cf0000"
	        filename = ""

Region:
	              id = 1695
	        start_va = 0x2e20000
	          end_va = 0x2e9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e20000"
	        filename = ""

Region:
	              id = 1696
	        start_va = 0x2ea0000
	          end_va = 0x309ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ea0000"
	        filename = ""

Region:
	              id = 1697
	        start_va = 0x30c0000
	          end_va = 0x313ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000030c0000"
	        filename = ""

Region:
	              id = 1698
	        start_va = 0x3140000
	          end_va = 0x31bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003140000"
	        filename = ""

Region:
	              id = 1699
	        start_va = 0x31c0000
	          end_va = 0x323ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000031c0000"
	        filename = ""

Region:
	              id = 1700
	        start_va = 0x3250000
	          end_va = 0x32cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003250000"
	        filename = ""

Region:
	              id = 1701
	        start_va = 0x3320000
	          end_va = 0x339ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003320000"
	        filename = ""

Region:
	              id = 1702
	        start_va = 0x3410000
	          end_va = 0x348ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003410000"
	        filename = ""

Region:
	              id = 1703
	        start_va = 0x3500000
	          end_va = 0x357ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003500000"
	        filename = ""

Region:
	              id = 1704
	        start_va = 0x3580000
	          end_va = 0x35fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003580000"
	        filename = ""

Region:
	              id = 1705
	        start_va = 0x3600000
	          end_va = 0x367ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003600000"
	        filename = ""

Region:
	              id = 1706
	        start_va = 0x36a0000
	          end_va = 0x371ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000036a0000"
	        filename = ""

Region:
	              id = 1707
	        start_va = 0x3800000
	          end_va = 0x387ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003800000"
	        filename = ""

Region:
	              id = 1708
	        start_va = 0x3890000
	          end_va = 0x390ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003890000"
	        filename = ""

Region:
	              id = 1709
	        start_va = 0x3910000
	          end_va = 0x398ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003910000"
	        filename = ""

Region:
	              id = 1710
	        start_va = 0x3990000
	          end_va = 0x3d8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003990000"
	        filename = ""

Region:
	              id = 1711
	        start_va = 0x3e20000
	          end_va = 0x3e9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e20000"
	        filename = ""

Region:
	              id = 1712
	        start_va = 0x3ff0000
	          end_va = 0x406ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003ff0000"
	        filename = ""

Region:
	              id = 1713
	        start_va = 0x4140000
	          end_va = 0x41bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004140000"
	        filename = ""

Region:
	              id = 1714
	        start_va = 0x4330000
	          end_va = 0x452ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004330000"
	        filename = ""

Region:
	              id = 1715
	        start_va = 0x4540000
	          end_va = 0x45bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004540000"
	        filename = ""

Region:
	              id = 1716
	        start_va = 0x45e0000
	          end_va = 0x465ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000045e0000"
	        filename = ""

Region:
	              id = 1717
	        start_va = 0x4660000
	          end_va = 0x475ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004660000"
	        filename = ""

Region:
	              id = 1718
	        start_va = 0x4840000
	          end_va = 0x484ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004840000"
	        filename = ""

Region:
	              id = 1719
	        start_va = 0x4850000
	          end_va = 0x490ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1720
	        start_va = 0x4910000
	          end_va = 0x4a0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004910000"
	        filename = ""

Region:
	              id = 1721
	        start_va = 0x4a10000
	          end_va = 0x4b0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a10000"
	        filename = ""

Region:
	              id = 1722
	        start_va = 0x4b10000
	          end_va = 0x4c0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004b10000"
	        filename = ""

Region:
	              id = 1723
	        start_va = 0x4c10000
	          end_va = 0x4d0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c10000"
	        filename = ""

Region:
	              id = 1724
	        start_va = 0x4d10000
	          end_va = 0x5d0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d10000"
	        filename = ""

Region:
	              id = 1725
	        start_va = 0x5d10000
	          end_va = 0x5d8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d10000"
	        filename = ""

Region:
	              id = 1726
	        start_va = 0x5d90000
	          end_va = 0x618ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d90000"
	        filename = ""

Region:
	              id = 1727
	        start_va = 0x62c0000
	          end_va = 0x633ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000062c0000"
	        filename = ""

Region:
	              id = 1728
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 0
	     entry_point = 0x774d5340
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1729
	        start_va = 0x775e0000
	          end_va = 0x776d9fff
	       monitored = 0
	     entry_point = 0x775fa2c8
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1730
	        start_va = 0x776e0000
	          end_va = 0x77888fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1731
	        start_va = 0x778b0000
	          end_va = 0x778b6fff
	       monitored = 0
	     entry_point = 0x778b106c
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")

Region:
	              id = 1732
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1733
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1734
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1735
	        start_va = 0xff8c0000
	          end_va = 0xff8cafff
	       monitored = 0
	     entry_point = 0xff8c246c
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 1736
	        start_va = 0x7fef0560000
	          end_va = 0x7fef07b2fff
	       monitored = 0
	     entry_point = 0x7fef056236c
	     region_type = mapped_file
	            name = "wuaueng.dll"
	        filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll")

Region:
	              id = 1737
	        start_va = 0x7fef1410000
	          end_va = 0x7fef15e3fff
	       monitored = 0
	     entry_point = 0x7fef1446b00
	     region_type = mapped_file
	            name = "msxml3.dll"
	        filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll")

Region:
	              id = 1738
	        start_va = 0x7fef1b60000
	          end_va = 0x7fef1b6efff
	       monitored = 0
	     entry_point = 0x7fef1b69a48
	     region_type = mapped_file
	            name = "mspatcha.dll"
	        filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll")

Region:
	              id = 1739
	        start_va = 0x7fef2630000
	          end_va = 0x7fef28a9fff
	       monitored = 0
	     entry_point = 0x7fef2662200
	     region_type = mapped_file
	            name = "esent.dll"
	        filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")

Region:
	              id = 1740
	        start_va = 0x7fef3fe0000
	          end_va = 0x7fef3ffbfff
	       monitored = 0
	     entry_point = 0x7fef3fe11a0
	     region_type = mapped_file
	            name = "rasman.dll"
	        filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll")

Region:
	              id = 1741
	        start_va = 0x7fef4000000
	          end_va = 0x7fef4061fff
	       monitored = 0
	     entry_point = 0x7fef4001198
	     region_type = mapped_file
	            name = "rasapi32.dll"
	        filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll")

Region:
	              id = 1742
	        start_va = 0x7fef4070000
	          end_va = 0x7fef40a9fff
	       monitored = 0
	     entry_point = 0x7fef4071010
	     region_type = mapped_file
	            name = "mprapi.dll"
	        filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll")

Region:
	              id = 1743
	        start_va = 0x7fef4720000
	          end_va = 0x7fef4790fff
	       monitored = 0
	     entry_point = 0x7fef475ecc4
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")

Region:
	              id = 1744
	        start_va = 0x7fef49a0000
	          end_va = 0x7fef49abfff
	       monitored = 0
	     entry_point = 0x7fef49a602c
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 1745
	        start_va = 0x7fef4ac0000
	          end_va = 0x7fef4adcfff
	       monitored = 0
	     entry_point = 0x7fef4ac2f18
	     region_type = mapped_file
	            name = "mmcss.dll"
	        filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll")

Region:
	              id = 1746
	        start_va = 0x7fef4d10000
	          end_va = 0x7fef4d17fff
	       monitored = 0
	     entry_point = 0x7fef4d11414
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 1747
	        start_va = 0x7fef4d20000
	          end_va = 0x7fef4d90fff
	       monitored = 0
	     entry_point = 0x7fef4d651d0
	     region_type = mapped_file
	            name = "wbemess.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll")

Region:
	              id = 1748
	        start_va = 0x7fef4da0000
	          end_va = 0x7fef4db1fff
	       monitored = 0
	     entry_point = 0x7fef4da89d0
	     region_type = mapped_file
	            name = "ncobjapi.dll"
	        filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")

Region:
	              id = 1749
	        start_va = 0x7fef4dc0000
	          end_va = 0x7fef4e74fff
	       monitored = 0
	     entry_point = 0x7fef4e3cf80
	     region_type = mapped_file
	            name = "wmiprvsd.dll"
	        filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll")

Region:
	              id = 1750
	        start_va = 0x7fef4e80000
	          end_va = 0x7fef4e98fff
	       monitored = 0
	     entry_point = 0x7fef4e81104
	     region_type = mapped_file
	            name = "resutils.dll"
	        filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll")

Region:
	              id = 1751
	        start_va = 0x7fef4ea0000
	          end_va = 0x7fef4eeffff
	       monitored = 0
	     entry_point = 0x7fef4ea1190
	     region_type = mapped_file
	            name = "clusapi.dll"
	        filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll")

Region:
	              id = 1752
	        start_va = 0x7fef4ef0000
	          end_va = 0x7fef4ef7fff
	       monitored = 0
	     entry_point = 0x7fef4ef1020
	     region_type = mapped_file
	            name = "sscore.dll"
	        filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll")

Region:
	              id = 1753
	        start_va = 0x7fef4f00000
	          end_va = 0x7fef4f59fff
	       monitored = 0
	     entry_point = 0x7fef4f3dde0
	     region_type = mapped_file
	            name = "repdrvfs.dll"
	        filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll")

Region:
	              id = 1754
	        start_va = 0x7fef4f60000
	          end_va = 0x7fef4f80fff
	       monitored = 0
	     entry_point = 0x7fef4f703b0
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")

Region:
	              id = 1755
	        start_va = 0x7fef4f90000
	          end_va = 0x7fef4ffafff
	       monitored = 0
	     entry_point = 0x7fef4fd4344
	     region_type = mapped_file
	            name = "hnetcfg.dll"
	        filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll")

Region:
	              id = 1756
	        start_va = 0x7fef5000000
	          end_va = 0x7fef5012fff
	       monitored = 0
	     entry_point = 0x7fef5001d80
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 1757
	        start_va = 0x7fef5020000
	          end_va = 0x7fef5081fff
	       monitored = 0
	     entry_point = 0x7fef505bd80
	     region_type = mapped_file
	            name = "esscli.dll"
	        filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll")

Region:
	              id = 1758
	        start_va = 0x7fef5090000
	          end_va = 0x7fef51bbfff
	       monitored = 0
	     entry_point = 0x7fef5140ef0
	     region_type = mapped_file
	            name = "wbemcore.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll")

Region:
	              id = 1759
	        start_va = 0x7fef51c0000
	          end_va = 0x7fef51d9fff
	       monitored = 0
	     entry_point = 0x7fef51d3fbc
	     region_type = mapped_file
	            name = "nci.dll"
	        filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll")

Region:
	              id = 1760
	        start_va = 0x7fef51e0000
	          end_va = 0x7fef5263fff
	       monitored = 0
	     entry_point = 0x7fef5231118
	     region_type = mapped_file
	            name = "netcfgx.dll"
	        filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll")

Region:
	              id = 1761
	        start_va = 0x7fef5270000
	          end_va = 0x7fef5294fff
	       monitored = 0
	     entry_point = 0x7fef5288c54
	     region_type = mapped_file
	            name = "browser.dll"
	        filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll")

Region:
	              id = 1762
	        start_va = 0x7fef52a0000
	          end_va = 0x7fef52dcfff
	       monitored = 0
	     entry_point = 0x7fef52a1070
	     region_type = mapped_file
	            name = "srvsvc.dll"
	        filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll")

Region:
	              id = 1763
	        start_va = 0x7fef52e0000
	          end_va = 0x7fef52edfff
	       monitored = 0
	     entry_point = 0x7fef52e5500
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 1764
	        start_va = 0x7fef52f0000
	          end_va = 0x7fef5316fff
	       monitored = 0
	     entry_point = 0x7fef52f11a0
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll")

Region:
	              id = 1765
	        start_va = 0x7fef5320000
	          end_va = 0x7fef53f2fff
	       monitored = 0
	     entry_point = 0x7fef5398b00
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 1766
	        start_va = 0x7fef5440000
	          end_va = 0x7fef5486fff
	       monitored = 0
	     entry_point = 0x7fef5441040
	     region_type = mapped_file
	            name = "wdscore.dll"
	        filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll")

Region:
	              id = 1767
	        start_va = 0x7fef5490000
	          end_va = 0x7fef54d1fff
	       monitored = 0
	     entry_point = 0x7fef54917e4
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll")

Region:
	              id = 1768
	        start_va = 0x7fef54e0000
	          end_va = 0x7fef54f0fff
	       monitored = 0
	     entry_point = 0x7fef54e14c0
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")

Region:
	              id = 1769
	        start_va = 0x7fef5500000
	          end_va = 0x7fef5591fff
	       monitored = 0
	     entry_point = 0x7fef55751ec
	     region_type = mapped_file
	            name = "iphlpsvc.dll"
	        filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll")

Region:
	              id = 1770
	        start_va = 0x7fef55a0000
	          end_va = 0x7fef5616fff
	       monitored = 0
	     entry_point = 0x7fef55de7f0
	     region_type = mapped_file
	            name = "wbemcomn2.dll"
	        filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll")

Region:
	              id = 1771
	        start_va = 0x7fef5620000
	          end_va = 0x7fef5659fff
	       monitored = 0
	     entry_point = 0x7fef563d020
	     region_type = mapped_file
	            name = "wmisvc.dll"
	        filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll")

Region:
	              id = 1772
	        start_va = 0x7fef5880000
	          end_va = 0x7fef5a2ffff
	       monitored = 0
	     entry_point = 0x7fef5881010
	     region_type = mapped_file
	            name = "vssapi.dll"
	        filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll")

Region:
	              id = 1773
	        start_va = 0x7fef69e0000
	          end_va = 0x7fef6a53fff
	       monitored = 0
	     entry_point = 0x7fef69e66f0
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 1774
	        start_va = 0x7fef7bd0000
	          end_va = 0x7fef7beafff
	       monitored = 0
	     entry_point = 0x7fef7bd1198
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 1775
	        start_va = 0x7fef7f60000
	          end_va = 0x7fef7fa4fff
	       monitored = 0
	     entry_point = 0x7fef7f93644
	     region_type = mapped_file
	            name = "upnp.dll"
	        filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll")

Region:
	              id = 1776
	        start_va = 0x7fef7fb0000
	          end_va = 0x7fef7fc1fff
	       monitored = 0
	     entry_point = 0x7fef7fb90bc
	     region_type = mapped_file
	            name = "bitsigd.dll"
	        filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll")

Region:
	              id = 1777
	        start_va = 0x7fef7fd0000
	          end_va = 0x7fef80a1fff
	       monitored = 0
	     entry_point = 0x7fef8061a10
	     region_type = mapped_file
	            name = "qmgr.dll"
	        filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll")

Region:
	              id = 1778
	        start_va = 0x7fef8240000
	          end_va = 0x7fef8254fff
	       monitored = 0
	     entry_point = 0x7fef8241020
	     region_type = mapped_file
	            name = "appinfo.dll"
	        filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll")

Region:
	              id = 1779
	        start_va = 0x7fef8260000
	          end_va = 0x7fef8268fff
	       monitored = 0
	     entry_point = 0x7fef82611a0
	     region_type = mapped_file
	            name = "tschannel.dll"
	        filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll")

Region:
	              id = 1780
	        start_va = 0x7fef85f0000
	          end_va = 0x7fef8606fff
	       monitored = 0
	     entry_point = 0x7fef85f9d50
	     region_type = mapped_file
	            name = "ncprov.dll"
	        filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll")

Region:
	              id = 1781
	        start_va = 0x7fef87c0000
	          end_va = 0x7fef883bfff
	       monitored = 0
	     entry_point = 0x7fef87c11d4
	     region_type = mapped_file
	            name = "wer.dll"
	        filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll")

Region:
	              id = 1782
	        start_va = 0x7fef8c40000
	          end_va = 0x7fef8d2dfff
	       monitored = 0
	     entry_point = 0x7fef8c412a0
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 1783
	        start_va = 0x7fef9000000
	          end_va = 0x7fef9041fff
	       monitored = 0
	     entry_point = 0x7fef9030048
	     region_type = mapped_file
	            name = "tcpipcfg.dll"
	        filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll")

Region:
	              id = 1784
	        start_va = 0x7fef9050000
	          end_va = 0x7fef9069fff
	       monitored = 0
	     entry_point = 0x7fef9061ae4
	     region_type = mapped_file
	            name = "rascfg.dll"
	        filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll")

Region:
	              id = 1785
	        start_va = 0x7fef9090000
	          end_va = 0x7fef909efff
	       monitored = 0
	     entry_point = 0x7fef9096894
	     region_type = mapped_file
	            name = "ndiscapcfg.dll"
	        filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll")

Region:
	              id = 1786
	        start_va = 0x7fefabb0000
	          end_va = 0x7fefac26fff
	       monitored = 0
	     entry_point = 0x7fefabbafd0
	     region_type = mapped_file
	            name = "taskcomp.dll"
	        filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll")

Region:
	              id = 1787
	        start_va = 0x7fefac50000
	          end_va = 0x7fefac59fff
	       monitored = 0
	     entry_point = 0x7fefac5260c
	     region_type = mapped_file
	            name = "ktmw32.dll"
	        filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll")

Region:
	              id = 1788
	        start_va = 0x7fefac60000
	          end_va = 0x7fefad71fff
	       monitored = 0
	     entry_point = 0x7fefac7f354
	     region_type = mapped_file
	            name = "schedsvc.dll"
	        filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll")

Region:
	              id = 1789
	        start_va = 0x7fefad80000
	          end_va = 0x7fefad8efff
	       monitored = 0
	     entry_point = 0x7fefad87e80
	     region_type = mapped_file
	            name = "wiarpc.dll"
	        filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll")

Region:
	              id = 1790
	        start_va = 0x7fefad90000
	          end_va = 0x7fefad98fff
	       monitored = 0
	     entry_point = 0x7fefad93668
	     region_type = mapped_file
	            name = "fvecerts.dll"
	        filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll")

Region:
	              id = 1791
	        start_va = 0x7fefada0000
	          end_va = 0x7fefada8fff
	       monitored = 0
	     entry_point = 0x7fefada1020
	     region_type = mapped_file
	            name = "tbs.dll"
	        filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll")

Region:
	              id = 1792
	        start_va = 0x7fefadb0000
	          end_va = 0x7fefae05fff
	       monitored = 0
	     entry_point = 0x7fefadb1040
	     region_type = mapped_file
	            name = "fveapi.dll"
	        filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll")

Region:
	              id = 1793
	        start_va = 0x7fefae10000
	          end_va = 0x7fefae6dfff
	       monitored = 0
	     entry_point = 0x7fefae19024
	     region_type = mapped_file
	            name = "shsvcs.dll"
	        filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll")

Region:
	              id = 1794
	        start_va = 0x7fefae70000
	          end_va = 0x7fefae87fff
	       monitored = 0
	     entry_point = 0x7fefae71bf8
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 1795
	        start_va = 0x7fefae90000
	          end_va = 0x7fefaea0fff
	       monitored = 0
	     entry_point = 0x7fefae916ac
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 1796
	        start_va = 0x7fefaee0000
	          end_va = 0x7fefaf32fff
	       monitored = 0
	     entry_point = 0x7fefaee2b98
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 1797
	        start_va = 0x7fefb0f0000
	          end_va = 0x7fefb103fff
	       monitored = 0
	     entry_point = 0x7fefb0f3e64
	     region_type = mapped_file
	            name = "sens.dll"
	        filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")

Region:
	              id = 1798
	        start_va = 0x7fefb110000
	          end_va = 0x7fefb11afff
	       monitored = 0
	     entry_point = 0x7fefb111198
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 1799
	        start_va = 0x7fefb120000
	          end_va = 0x7fefb146fff
	       monitored = 0
	     entry_point = 0x7fefb1298bc
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 1800
	        start_va = 0x7fefb150000
	          end_va = 0x7fefb1b6fff
	       monitored = 0
	     entry_point = 0x7fefb166060
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 1801
	        start_va = 0x7fefb1d0000
	          end_va = 0x7fefb1dafff
	       monitored = 0
	     entry_point = 0x7fefb1d4f8c
	     region_type = mapped_file
	            name = "slc.dll"
	        filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll")

Region:
	              id = 1802
	        start_va = 0x7fefb1e0000
	          end_va = 0x7fefb1ebfff
	       monitored = 0
	     entry_point = 0x7fefb1e15d8
	     region_type = mapped_file
	            name = "dsrole.dll"
	        filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")

Region:
	              id = 1803
	        start_va = 0x7fefb1f0000
	          end_va = 0x7fefb1fffff
	       monitored = 0
	     entry_point = 0x7fefb1f835c
	     region_type = mapped_file
	            name = "themeservice.dll"
	        filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll")

Region:
	              id = 1804
	        start_va = 0x7fefb200000
	          end_va = 0x7fefb218fff
	       monitored = 0
	     entry_point = 0x7fefb2011a8
	     region_type = mapped_file
	            name = "atl.dll"
	        filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")

Region:
	              id = 1805
	        start_va = 0x7fefb220000
	          end_va = 0x7fefb256fff
	       monitored = 0
	     entry_point = 0x7fefb228424
	     region_type = mapped_file
	            name = "profsvc.dll"
	        filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll")

Region:
	              id = 1806
	        start_va = 0x7fefb2a0000
	          end_va = 0x7fefb2b4fff
	       monitored = 0
	     entry_point = 0x7fefb2a60d8
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 1807
	        start_va = 0x7fefb2c0000
	          end_va = 0x7fefb381fff
	       monitored = 0
	     entry_point = 0x7fefb2c101c
	     region_type = mapped_file
	            name = "gpsvc.dll"
	        filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll")

Region:
	              id = 1808
	        start_va = 0x7fefb5b0000
	          end_va = 0x7fefb5b9fff
	       monitored = 0
	     entry_point = 0x7fefb5b3994
	     region_type = mapped_file
	            name = "bitsperf.dll"
	        filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll")

Region:
	              id = 1809
	        start_va = 0x7fefb5c0000
	          end_va = 0x7fefb5c8fff
	       monitored = 0
	     entry_point = 0x7fefb5c1010
	     region_type = mapped_file
	            name = "avrt.dll"
	        filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll")

Region:
	              id = 1810
	        start_va = 0x7fefb6b0000
	          end_va = 0x7fefb6dcfff
	       monitored = 0
	     entry_point = 0x7fefb6b1010
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 1811
	        start_va = 0x7fefb6e0000
	          end_va = 0x7fefb6f0fff
	       monitored = 0
	     entry_point = 0x7fefb6e9e7c
	     region_type = mapped_file
	            name = "ssdpapi.dll"
	        filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll")

Region:
	              id = 1812
	        start_va = 0x7fefb700000
	          end_va = 0x7fefb763fff
	       monitored = 0
	     entry_point = 0x7fefb701254
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 1813
	        start_va = 0x7fefb770000
	          end_va = 0x7fefb7e0fff
	       monitored = 0
	     entry_point = 0x7fefb771010
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 1814
	        start_va = 0x7fefb830000
	          end_va = 0x7fefb843fff
	       monitored = 0
	     entry_point = 0x7fefb8316b4
	     region_type = mapped_file
	            name = "samcli.dll"
	        filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")

Region:
	              id = 1815
	        start_va = 0x7fefb850000
	          end_va = 0x7fefb864fff
	       monitored = 0
	     entry_point = 0x7fefb851050
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 1816
	        start_va = 0x7fefb870000
	          end_va = 0x7fefb87bfff
	       monitored = 0
	     entry_point = 0x7fefb8718a4
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 1817
	        start_va = 0x7fefb880000
	          end_va = 0x7fefb895fff
	       monitored = 0
	     entry_point = 0x7fefb8811a0
	     region_type = mapped_file
	            name = "netapi32.dll"
	        filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")

Region:
	              id = 1818
	        start_va = 0x7fefb910000
	          end_va = 0x7fefb926fff
	       monitored = 0
	     entry_point = 0x7fefb911060
	     region_type = mapped_file
	            name = "vsstrace.dll"
	        filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll")

Region:
	              id = 1819
	        start_va = 0x7fefb9b0000
	          end_va = 0x7fefb9c0fff
	       monitored = 0
	     entry_point = 0x7fefb9b1070
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 1820
	        start_va = 0x7fefbb10000
	          end_va = 0x7fefbb44fff
	       monitored = 0
	     entry_point = 0x7fefbb11064
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 1821
	        start_va = 0x7fefbf80000
	          end_va = 0x7fefbfd5fff
	       monitored = 0
	     entry_point = 0x7fefbf8bbc0
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 1822
	        start_va = 0x7fefbfe0000
	          end_va = 0x7fefc10bfff
	       monitored = 0
	     entry_point = 0x7fefbfe94bc
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 1823
	        start_va = 0x7fefc110000
	          end_va = 0x7fefc12cfff
	       monitored = 0
	     entry_point = 0x7fefc111ef4
	     region_type = mapped_file
	            name = "samlib.dll"
	        filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")

Region:
	              id = 1824
	        start_va = 0x7fefc160000
	          end_va = 0x7fefc353fff
	       monitored = 0
	     entry_point = 0x7fefc2ec924
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")

Region:
	              id = 1825
	        start_va = 0x7fefc7f0000
	          end_va = 0x7fefc7fbfff
	       monitored = 0
	     entry_point = 0x7fefc7f1064
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 1826
	        start_va = 0x7fefc800000
	          end_va = 0x7fefc8bafff
	       monitored = 0
	     entry_point = 0x7fefc806de0
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 1827
	        start_va = 0x7fefc8c0000
	          end_va = 0x7fefc8c6fff
	       monitored = 0
	     entry_point = 0x7fefc8c14b0
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 1828
	        start_va = 0x7fefc9b0000
	          end_va = 0x7fefc9cafff
	       monitored = 0
	     entry_point = 0x7fefc9b2068
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 1829
	        start_va = 0x7fefc9d0000
	          end_va = 0x7fefc9edfff
	       monitored = 0
	     entry_point = 0x7fefc9d13b8
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 1830
	        start_va = 0x7fefc9f0000
	          end_va = 0x7fefca01fff
	       monitored = 0
	     entry_point = 0x7fefc9f1060
	     region_type = mapped_file
	            name = "devrtl.dll"
	        filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll")

Region:
	              id = 1831
	        start_va = 0x7fefca10000
	          end_va = 0x7fefca2efff
	       monitored = 0
	     entry_point = 0x7fefca15c68
	     region_type = mapped_file
	            name = "spinf.dll"
	        filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll")

Region:
	              id = 1832
	        start_va = 0x7fefcae0000
	          end_va = 0x7fefcb18fff
	       monitored = 0
	     entry_point = 0x7fefcaec0f0
	     region_type = mapped_file
	            name = "ubpm.dll"
	        filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll")

Region:
	              id = 1833
	        start_va = 0x7fefcb20000
	          end_va = 0x7fefcb29fff
	       monitored = 0
	     entry_point = 0x7fefcb23cb8
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 1834
	        start_va = 0x7fefcb30000
	          end_va = 0x7fefcb3cfff
	       monitored = 0
	     entry_point = 0x7fefcb31348
	     region_type = mapped_file
	            name = "pcwum.dll"
	        filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll")

Region:
	              id = 1835
	        start_va = 0x7fefcc20000
	          end_va = 0x7fefcc66fff
	       monitored = 0
	     entry_point = 0x7fefcc21064
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1836
	        start_va = 0x7fefcd10000
	          end_va = 0x7fefcd3ffff
	       monitored = 0
	     entry_point = 0x7fefcd1194c
	     region_type = mapped_file
	            name = "logoncli.dll"
	        filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")

Region:
	              id = 1837
	        start_va = 0x7fefcd40000
	          end_va = 0x7fefcd9afff
	       monitored = 0
	     entry_point = 0x7fefcd46940
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 1838
	        start_va = 0x7fefceb0000
	          end_va = 0x7fefceb6fff
	       monitored = 0
	     entry_point = 0x7fefceb142c
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 1839
	        start_va = 0x7fefcec0000
	          end_va = 0x7fefcf14fff
	       monitored = 0
	     entry_point = 0x7fefcec1054
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 1840
	        start_va = 0x7fefcf20000
	          end_va = 0x7fefcf37fff
	       monitored = 0
	     entry_point = 0x7fefcf23b48
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1841
	        start_va = 0x7fefd030000
	          end_va = 0x7fefd061fff
	       monitored = 0
	     entry_point = 0x7fefd03144c
	     region_type = mapped_file
	            name = "netjoin.dll"
	        filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll")

Region:
	              id = 1842
	        start_va = 0x7fefd070000
	          end_va = 0x7fefd077fff
	       monitored = 0
	     entry_point = 0x7fefd072a6c
	     region_type = mapped_file
	            name = "wmsgapi.dll"
	        filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll")

Region:
	              id = 1843
	        start_va = 0x7fefd080000
	          end_va = 0x7fefd089fff
	       monitored = 0
	     entry_point = 0x7fefd083b40
	     region_type = mapped_file
	            name = "sysntfy.dll"
	        filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll")

Region:
	              id = 1844
	        start_va = 0x7fefd090000
	          end_va = 0x7fefd0b1fff
	       monitored = 0
	     entry_point = 0x7fefd095d30
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 1845
	        start_va = 0x7fefd110000
	          end_va = 0x7fefd13efff
	       monitored = 0
	     entry_point = 0x7fefd111064
	     region_type = mapped_file
	            name = "authz.dll"
	        filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll")

Region:
	              id = 1846
	        start_va = 0x7fefd150000
	          end_va = 0x7fefd1bcfff
	       monitored = 0
	     entry_point = 0x7fefd151010
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 1847
	        start_va = 0x7fefd1c0000
	          end_va = 0x7fefd1d3fff
	       monitored = 0
	     entry_point = 0x7fefd1c4160
	     region_type = mapped_file
	            name = "cryptdll.dll"
	        filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll")

Region:
	              id = 1848
	        start_va = 0x7fefd420000
	          end_va = 0x7fefd442fff
	       monitored = 0
	     entry_point = 0x7fefd421198
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 1849
	        start_va = 0x7fefd4c0000
	          end_va = 0x7fefd4cafff
	       monitored = 0
	     entry_point = 0x7fefd4c1030
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 1850
	        start_va = 0x7fefd4f0000
	          end_va = 0x7fefd514fff
	       monitored = 0
	     entry_point = 0x7fefd4f9658
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1851
	        start_va = 0x7fefd520000
	          end_va = 0x7fefd52efff
	       monitored = 0
	     entry_point = 0x7fefd521010
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1852
	        start_va = 0x7fefd530000
	          end_va = 0x7fefd5c0fff
	       monitored = 0
	     entry_point = 0x7fefd531440
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")

Region:
	              id = 1853
	        start_va = 0x7fefd5d0000
	          end_va = 0x7fefd60cfff
	       monitored = 0
	     entry_point = 0x7fefd5d18f4
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 1854
	        start_va = 0x7fefd610000
	          end_va = 0x7fefd623fff
	       monitored = 0
	     entry_point = 0x7fefd6110e0
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 1855
	        start_va = 0x7fefd630000
	          end_va = 0x7fefd63efff
	       monitored = 0
	     entry_point = 0x7fefd6319b0
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 1856
	        start_va = 0x7fefd6d0000
	          end_va = 0x7fefd6defff
	       monitored = 0
	     entry_point = 0x7fefd6d1020
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 1857
	        start_va = 0x7fefd6e0000
	          end_va = 0x7fefd6f9fff
	       monitored = 0
	     entry_point = 0x7fefd6e1558
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1858
	        start_va = 0x7fefd700000
	          end_va = 0x7fefd735fff
	       monitored = 0
	     entry_point = 0x7fefd701474
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1859
	        start_va = 0x7fefd7e0000
	          end_va = 0x7fefd84bfff
	       monitored = 0
	     entry_point = 0x7fefd7e2780
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1860
	        start_va = 0x7fefd850000
	          end_va = 0x7fefd9bcfff
	       monitored = 0
	     entry_point = 0x7fefd8510b4
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 1861
	        start_va = 0x7fefd9c0000
	          end_va = 0x7fefd9fafff
	       monitored = 0
	     entry_point = 0x7fefd9c1324
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 1862
	        start_va = 0x7fefda00000
	          end_va = 0x7fefdb2cfff
	       monitored = 0
	     entry_point = 0x7fefda4ed50
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1863
	        start_va = 0x7fefdb30000
	          end_va = 0x7fefdbf8fff
	       monitored = 0
	     entry_point = 0x7fefdbaa874
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1864
	        start_va = 0x7fefdc00000
	          end_va = 0x7fefdc0dfff
	       monitored = 0
	     entry_point = 0x7fefdc01080
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1865
	        start_va = 0x7fefdc10000
	          end_va = 0x7fefdc17fff
	       monitored = 0
	     entry_point = 0x7fefdc11504
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 1866
	        start_va = 0x7fefdc20000
	          end_va = 0x7fefdc90fff
	       monitored = 0
	     entry_point = 0x7fefdc31e20
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 1867
	        start_va = 0x7fefdca0000
	          end_va = 0x7fefdd06fff
	       monitored = 0
	     entry_point = 0x7fefdcab03c
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 1868
	        start_va = 0x7fefdd10000
	          end_va = 0x7fefdd5cfff
	       monitored = 0
	     entry_point = 0x7fefdd11070
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 1869
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefdd7efff
	       monitored = 0
	     entry_point = 0x7fefdd660e8
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 1870
	        start_va = 0x7fefdd80000
	          end_va = 0x7fefdf82fff
	       monitored = 0
	     entry_point = 0x7fefdda3330
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 1871
	        start_va = 0x7fefdf90000
	          end_va = 0x7fefdfe1fff
	       monitored = 0
	     entry_point = 0x7fefdf910d4
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 1872
	        start_va = 0x7fefdff0000
	          end_va = 0x7fefe01dfff
	       monitored = 0
	     entry_point = 0x7fefdff1010
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 1873
	        start_va = 0x7fefe020000
	          end_va = 0x7fefe0fafff
	       monitored = 0
	     entry_point = 0x7fefe040760
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 1874
	        start_va = 0x7fefe280000
	          end_va = 0x7fefe456fff
	       monitored = 0
	     entry_point = 0x7fefe281010
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 1875
	        start_va = 0x7fefe4e0000
	          end_va = 0x7fefe5e8fff
	       monitored = 0
	     entry_point = 0x7fefe4e1064
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 1876
	        start_va = 0x7fefe850000
	          end_va = 0x7fefe8e8fff
	       monitored = 0
	     entry_point = 0x7fefe851c10
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 1877
	        start_va = 0x7fefe8f0000
	          end_va = 0x7fefe9c6fff
	       monitored = 0
	     entry_point = 0x7fefe8f3274
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 1878
	        start_va = 0x7fefea70000
	          end_va = 0x7feff7f7fff
	       monitored = 0
	     entry_point = 0x7fefeaecebc
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 1879
	        start_va = 0x7feff930000
	          end_va = 0x7feff9cefff
	       monitored = 0
	     entry_point = 0x7feff9325a0
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 1880
	        start_va = 0x7feffa00000
	          end_va = 0x7feffa00fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 1881
	        start_va = 0x7fffff52000
	          end_va = 0x7fffff53fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff52000"
	        filename = ""

Region:
	              id = 1882
	        start_va = 0x7fffff56000
	          end_va = 0x7fffff57fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff56000"
	        filename = ""

Region:
	              id = 1883
	        start_va = 0x7fffff60000
	          end_va = 0x7fffff61fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff60000"
	        filename = ""

Region:
	              id = 1884
	        start_va = 0x7fffff62000
	          end_va = 0x7fffff63fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff62000"
	        filename = ""

Region:
	              id = 1885
	        start_va = 0x7fffff64000
	          end_va = 0x7fffff65fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff64000"
	        filename = ""

Region:
	              id = 1886
	        start_va = 0x7fffff6e000
	          end_va = 0x7fffff6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff6e000"
	        filename = ""

Region:
	              id = 1887
	        start_va = 0x7fffff74000
	          end_va = 0x7fffff75fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff74000"
	        filename = ""

Region:
	              id = 1888
	        start_va = 0x7fffff78000
	          end_va = 0x7fffff79fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff78000"
	        filename = ""

Region:
	              id = 1889
	        start_va = 0x7fffff7a000
	          end_va = 0x7fffff7bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7a000"
	        filename = ""

Region:
	              id = 1890
	        start_va = 0x7fffff7c000
	          end_va = 0x7fffff7dfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff7c000"
	        filename = ""

Region:
	              id = 1891
	        start_va = 0x7fffff80000
	          end_va = 0x7fffff81fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff80000"
	        filename = ""

Region:
	              id = 1892
	        start_va = 0x7fffff86000
	          end_va = 0x7fffff87fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff86000"
	        filename = ""

Region:
	              id = 1893
	        start_va = 0x7fffff88000
	          end_va = 0x7fffff89fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff88000"
	        filename = ""

Region:
	              id = 1894
	        start_va = 0x7fffff8c000
	          end_va = 0x7fffff8dfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8c000"
	        filename = ""

Region:
	              id = 1895
	        start_va = 0x7fffff8e000
	          end_va = 0x7fffff8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8e000"
	        filename = ""

Region:
	              id = 1896
	        start_va = 0x7fffff90000
	          end_va = 0x7fffff91fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff90000"
	        filename = ""

Region:
	              id = 1897
	        start_va = 0x7fffff92000
	          end_va = 0x7fffff93fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff92000"
	        filename = ""

Region:
	              id = 1898
	        start_va = 0x7fffff94000
	          end_va = 0x7fffff95fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff94000"
	        filename = ""

Region:
	              id = 1899
	        start_va = 0x7fffff96000
	          end_va = 0x7fffff97fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff96000"
	        filename = ""

Region:
	              id = 1900
	        start_va = 0x7fffff98000
	          end_va = 0x7fffff99fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff98000"
	        filename = ""

Region:
	              id = 1901
	        start_va = 0x7fffff9a000
	          end_va = 0x7fffff9bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9a000"
	        filename = ""

Region:
	              id = 1902
	        start_va = 0x7fffff9c000
	          end_va = 0x7fffff9dfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9c000"
	        filename = ""

Region:
	              id = 1903
	        start_va = 0x7fffff9e000
	          end_va = 0x7fffff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9e000"
	        filename = ""

Region:
	              id = 1904
	        start_va = 0x7fffffa0000
	          end_va = 0x7fffffa1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa0000"
	        filename = ""

Region:
	              id = 1905
	        start_va = 0x7fffffa2000
	          end_va = 0x7fffffa3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa2000"
	        filename = ""

Region:
	              id = 1906
	        start_va = 0x7fffffa4000
	          end_va = 0x7fffffa5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa4000"
	        filename = ""

Region:
	              id = 1907
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 1908
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 1909
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 1910
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 1911
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 1912
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 1913
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 1914
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 1915
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 1916
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 1917
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdbfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 1918
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffddfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 1919
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 2027
	        start_va = 0x2b20000
	          end_va = 0x2bc9fff
	       monitored = 0
	     entry_point = 0x2b24104
	     region_type = mapped_file
	            name = "wuapi.dll"
	        filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll")

Region:
	              id = 2028
	        start_va = 0x920000
	          end_va = 0x92cfff
	       monitored = 0
	     entry_point = 0x92a138
	     region_type = mapped_file
	            name = "wuauclt.exe"
	        filename = "\\Windows\\System32\\wuauclt.exe" (normalized: "c:\\windows\\system32\\wuauclt.exe")

Region:
	              id = 2029
	        start_va = 0x6340000
	          end_va = 0x658efff
	       monitored = 0
	     entry_point = 0x634236c
	     region_type = mapped_file
	            name = "wuaueng.dll"
	        filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll")

Region:
	              id = 2030
	        start_va = 0x920000
	          end_va = 0x920fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000920000"
	        filename = ""

Region:
	              id = 2031
	        start_va = 0x3da0000
	          end_va = 0x3e1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003da0000"
	        filename = ""

Region:
	              id = 2032
	        start_va = 0x7fffff8a000
	          end_va = 0x7fffff8bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8a000"
	        filename = ""

Region:
	              id = 2033
	        start_va = 0x920000
	          end_va = 0x920fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000920000"
	        filename = ""

Region:
	              id = 2034
	        start_va = 0x930000
	          end_va = 0x93ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2035
	        start_va = 0x940000
	          end_va = 0x94ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2036
	        start_va = 0x9e0000
	          end_va = 0x9effff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2037
	        start_va = 0x9f0000
	          end_va = 0x9fffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2038
	        start_va = 0x12b0000
	          end_va = 0x12bffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2039
	        start_va = 0x7fef0cd0000
	          end_va = 0x7fef0d01fff
	       monitored = 0
	     entry_point = 0x7fef0cd1060
	     region_type = mapped_file
	            name = "dssenh.dll"
	        filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll")

Region:
	              id = 2045
	        start_va = 0x900000
	          end_va = 0x907fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000900000"
	        filename = ""

Region:
	              id = 2046
	        start_va = 0x930000
	          end_va = 0x93ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2395
	        start_va = 0x17d0000
	          end_va = 0x184ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000017d0000"
	        filename = ""

Region:
	              id = 2396
	        start_va = 0x1fd0000
	          end_va = 0x204ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fd0000"
	        filename = ""

Region:
	              id = 2397
	        start_va = 0x2140000
	          end_va = 0x21bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002140000"
	        filename = ""

Region:
	              id = 2398
	        start_va = 0x27c0000
	          end_va = 0x283ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027c0000"
	        filename = ""

Region:
	              id = 2399
	        start_va = 0x3720000
	          end_va = 0x379ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003720000"
	        filename = ""

Region:
	              id = 2400
	        start_va = 0x7fffff90000
	          end_va = 0x7fffff91fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff90000"
	        filename = ""

Region:
	              id = 2818
	        start_va = 0x2b50000
	          end_va = 0x2bcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b50000"
	        filename = ""

Region:
	              id = 2819
	        start_va = 0x7fffff88000
	          end_va = 0x7fffff89fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff88000"
	        filename = ""


Thread:
	id = 16
	os_tid = 0xff0


Thread:
	id = 17
	os_tid = 0xfec


Thread:
	id = 18
	os_tid = 0xfe8


Thread:
	id = 19
	os_tid = 0xfe4


Thread:
	id = 20
	os_tid = 0xf84


Thread:
	id = 21
	os_tid = 0xf80


Thread:
	id = 22
	os_tid = 0xf7c


Thread:
	id = 23
	os_tid = 0xf14


Thread:
	id = 24
	os_tid = 0xf10


Thread:
	id = 25
	os_tid = 0xd5c


Thread:
	id = 26
	os_tid = 0x318


Thread:
	id = 27
	os_tid = 0x21c


Thread:
	id = 28
	os_tid = 0x6c0


Thread:
	id = 29
	os_tid = 0x720


Thread:
	id = 30
	os_tid = 0x530


Thread:
	id = 31
	os_tid = 0x94


Thread:
	id = 32
	os_tid = 0xc8


Thread:
	id = 33
	os_tid = 0xc4


Thread:
	id = 34
	os_tid = 0x310


Thread:
	id = 35
	os_tid = 0x418


Thread:
	id = 36
	os_tid = 0x2a8


Thread:
	id = 37
	os_tid = 0x70c


Thread:
	id = 38
	os_tid = 0x6e8


Thread:
	id = 39
	os_tid = 0x6c8


Thread:
	id = 40
	os_tid = 0x6ac


Thread:
	id = 41
	os_tid = 0x69c


Thread:
	id = 42
	os_tid = 0x688


Thread:
	id = 43
	os_tid = 0x44c


Thread:
	id = 44
	os_tid = 0x440


Thread:
	id = 45
	os_tid = 0x430


Thread:
	id = 46
	os_tid = 0x428


Thread:
	id = 47
	os_tid = 0x41c


Thread:
	id = 48
	os_tid = 0x3f0


Thread:
	id = 49
	os_tid = 0x3e8


Thread:
	id = 50
	os_tid = 0x3dc


Thread:
	id = 51
	os_tid = 0x370


Thread:
	id = 52
	os_tid = 0x368


Thread:
	id = 69
	os_tid = 0xff8


Thread:
	id = 89
	os_tid = 0xb34


Thread:
	id = 90
	os_tid = 0xb38


Thread:
	id = 91
	os_tid = 0xb3c


Thread:
	id = 92
	os_tid = 0xb40


Thread:
	id = 95
	os_tid = 0xb10


Thread:
	id = 101
	os_tid = 0xaf0


Thread:
	id = 150
	os_tid = 0x824


Thread:
	id = 151
	os_tid = 0xd74


Thread:
	id = 152
	os_tid = 0xd7c


Thread:
	id = 153
	os_tid = 0x820


Thread:
	id = 154
	os_tid = 0xd68


Thread:
	id = 155
	os_tid = 0xd60


Thread:
	id = 156
	os_tid = 0xd58


Process:
	id = "4"
	image_name = "wmiprvse.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
	page_root = "0x4682f000"
	os_pid = "0xd0c"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "3"
	os_parent_pid = "0x248"
	cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Network Service"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000480c8" [0xc000000f]

Region:
	              id = 1920
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1921
	        start_va = 0x20000
	          end_va = 0x20fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1922
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1923
	        start_va = 0x40000
	          end_va = 0x40fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1924
	        start_va = 0x50000
	          end_va = 0x50fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 1925
	        start_va = 0x60000
	          end_va = 0x6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1926
	        start_va = 0x70000
	          end_va = 0x74fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "user32.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")

Region:
	              id = 1927
	        start_va = 0x80000
	          end_va = 0x80fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000080000"
	        filename = ""

Region:
	              id = 1928
	        start_va = 0x90000
	          end_va = 0x90fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000090000"
	        filename = ""

Region:
	              id = 1929
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1930
	        start_va = 0x1a0000
	          end_va = 0x1a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1931
	        start_va = 0x1b0000
	          end_va = 0x1bcfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "setupapi.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui")

Region:
	              id = 1932
	        start_va = 0x1d0000
	          end_va = 0x24ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 1933
	        start_va = 0x250000
	          end_va = 0x2b6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1934
	        start_va = 0x2c0000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002c0000"
	        filename = ""

Region:
	              id = 1935
	        start_va = 0x3c0000
	          end_va = 0x547fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003c0000"
	        filename = ""

Region:
	              id = 1936
	        start_va = 0x550000
	          end_va = 0x6d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000550000"
	        filename = ""

Region:
	              id = 1937
	        start_va = 0x6e0000
	          end_va = 0x79ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006e0000"
	        filename = ""

Region:
	              id = 1938
	        start_va = 0x7a0000
	          end_va = 0xa6efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1939
	        start_va = 0xa80000
	          end_va = 0xa82fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cimwin32.dll.mui"
	        filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui")

Region:
	              id = 1940
	        start_va = 0xaf0000
	          end_va = 0xb6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000af0000"
	        filename = ""

Region:
	              id = 1941
	        start_va = 0xbb0000
	          end_va = 0xc2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000bb0000"
	        filename = ""

Region:
	              id = 1942
	        start_va = 0xc30000
	          end_va = 0xcaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c30000"
	        filename = ""

Region:
	              id = 1943
	        start_va = 0xd20000
	          end_va = 0xd9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d20000"
	        filename = ""

Region:
	              id = 1944
	        start_va = 0xdb0000
	          end_va = 0xe2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 1945
	        start_va = 0xfa0000
	          end_va = 0x101ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fa0000"
	        filename = ""

Region:
	              id = 1946
	        start_va = 0x1020000
	          end_va = 0x111ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001020000"
	        filename = ""

Region:
	              id = 1947
	        start_va = 0x1180000
	          end_va = 0x11fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001180000"
	        filename = ""

Region:
	              id = 1948
	        start_va = 0x72cb0000
	          end_va = 0x72cb2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "security.dll"
	        filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll")

Region:
	              id = 1949
	        start_va = 0x72cc0000
	          end_va = 0x72cc2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wmi.dll"
	        filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll")

Region:
	              id = 1950
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 0
	     entry_point = 0x774d5340
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 1951
	        start_va = 0x775e0000
	          end_va = 0x776d9fff
	       monitored = 0
	     entry_point = 0x775fa2c8
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 1952
	        start_va = 0x776e0000
	          end_va = 0x77888fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1953
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 1954
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 1955
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1956
	        start_va = 0x13fdc0000
	          end_va = 0x13fe2bfff
	       monitored = 0
	     entry_point = 0x13fdfb450
	     region_type = mapped_file
	            name = "wmiprvse.exe"
	        filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe")

Region:
	              id = 1957
	        start_va = 0x7fef09a0000
	          end_va = 0x7fef0b99fff
	       monitored = 0
	     entry_point = 0x7fef09b4c9c
	     region_type = mapped_file
	            name = "cimwin32.dll"
	        filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll")

Region:
	              id = 1958
	        start_va = 0x7fef1290000
	          end_va = 0x7fef12a1fff
	       monitored = 0
	     entry_point = 0x7fef129aab8
	     region_type = mapped_file
	            name = "browcli.dll"
	        filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll")

Region:
	              id = 1959
	        start_va = 0x7fef1350000
	          end_va = 0x7fef1357fff
	       monitored = 0
	     entry_point = 0x7fef13511a0
	     region_type = mapped_file
	            name = "winbrand.dll"
	        filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")

Region:
	              id = 1960
	        start_va = 0x7fef1360000
	          end_va = 0x7fef1369fff
	       monitored = 0
	     entry_point = 0x7fef13631c8
	     region_type = mapped_file
	            name = "schedcli.dll"
	        filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll")

Region:
	              id = 1961
	        start_va = 0x7fef4da0000
	          end_va = 0x7fef4db1fff
	       monitored = 0
	     entry_point = 0x7fef4da89d0
	     region_type = mapped_file
	            name = "ncobjapi.dll"
	        filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")

Region:
	              id = 1962
	        start_va = 0x7fef4f60000
	          end_va = 0x7fef4f80fff
	       monitored = 0
	     entry_point = 0x7fef4f703b0
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")

Region:
	              id = 1963
	        start_va = 0x7fef5000000
	          end_va = 0x7fef5012fff
	       monitored = 0
	     entry_point = 0x7fef5001d80
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 1964
	        start_va = 0x7fef52e0000
	          end_va = 0x7fef52edfff
	       monitored = 0
	     entry_point = 0x7fef52e5500
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 1965
	        start_va = 0x7fef52f0000
	          end_va = 0x7fef5316fff
	       monitored = 0
	     entry_point = 0x7fef52f11a0
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll")

Region:
	              id = 1966
	        start_va = 0x7fef5320000
	          end_va = 0x7fef53f2fff
	       monitored = 0
	     entry_point = 0x7fef5398b00
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 1967
	        start_va = 0x7fef55a0000
	          end_va = 0x7fef5616fff
	       monitored = 0
	     entry_point = 0x7fef55de7f0
	     region_type = mapped_file
	            name = "wbemcomn2.dll"
	        filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll")

Region:
	              id = 1968
	        start_va = 0x7fef8df0000
	          end_va = 0x7fef8e32fff
	       monitored = 0
	     entry_point = 0x7fef8e11b50
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll")

Region:
	              id = 1969
	        start_va = 0x7fef9140000
	          end_va = 0x7fef914efff
	       monitored = 0
	     entry_point = 0x7fef9141040
	     region_type = mapped_file
	            name = "cscapi.dll"
	        filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")

Region:
	              id = 1970
	        start_va = 0x7fefb1e0000
	          end_va = 0x7fefb1ebfff
	       monitored = 0
	     entry_point = 0x7fefb1e15d8
	     region_type = mapped_file
	            name = "dsrole.dll"
	        filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")

Region:
	              id = 1971
	        start_va = 0x7fefb5d0000
	          end_va = 0x7fefb5fbfff
	       monitored = 0
	     entry_point = 0x7fefb5d15c4
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 1972
	        start_va = 0x7fefb6b0000
	          end_va = 0x7fefb6dcfff
	       monitored = 0
	     entry_point = 0x7fefb6b1010
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 1973
	        start_va = 0x7fefb830000
	          end_va = 0x7fefb843fff
	       monitored = 0
	     entry_point = 0x7fefb8316b4
	     region_type = mapped_file
	            name = "samcli.dll"
	        filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")

Region:
	              id = 1974
	        start_va = 0x7fefb850000
	          end_va = 0x7fefb864fff
	       monitored = 0
	     entry_point = 0x7fefb851050
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 1975
	        start_va = 0x7fefb870000
	          end_va = 0x7fefb87bfff
	       monitored = 0
	     entry_point = 0x7fefb8718a4
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 1976
	        start_va = 0x7fefb880000
	          end_va = 0x7fefb895fff
	       monitored = 0
	     entry_point = 0x7fefb8811a0
	     region_type = mapped_file
	            name = "netapi32.dll"
	        filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")

Region:
	              id = 1977
	        start_va = 0x7fefb9b0000
	          end_va = 0x7fefb9c0fff
	       monitored = 0
	     entry_point = 0x7fefb9b1070
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 1978
	        start_va = 0x7fefcb20000
	          end_va = 0x7fefcb29fff
	       monitored = 0
	     entry_point = 0x7fefcb23cb8
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 1979
	        start_va = 0x7fefcc20000
	          end_va = 0x7fefcc66fff
	       monitored = 0
	     entry_point = 0x7fefcc21064
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 1980
	        start_va = 0x7fefccb0000
	          end_va = 0x7fefcd06fff
	       monitored = 0
	     entry_point = 0x7fefccb5e38
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")

Region:
	              id = 1981
	        start_va = 0x7fefcd10000
	          end_va = 0x7fefcd3ffff
	       monitored = 0
	     entry_point = 0x7fefcd1194c
	     region_type = mapped_file
	            name = "logoncli.dll"
	        filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")

Region:
	              id = 1982
	        start_va = 0x7fefcf20000
	          end_va = 0x7fefcf37fff
	       monitored = 0
	     entry_point = 0x7fefcf23b48
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 1983
	        start_va = 0x7fefd090000
	          end_va = 0x7fefd0b1fff
	       monitored = 0
	     entry_point = 0x7fefd095d30
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 1984
	        start_va = 0x7fefd420000
	          end_va = 0x7fefd442fff
	       monitored = 0
	     entry_point = 0x7fefd421198
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")

Region:
	              id = 1985
	        start_va = 0x7fefd4c0000
	          end_va = 0x7fefd4cafff
	       monitored = 0
	     entry_point = 0x7fefd4c1030
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 1986
	        start_va = 0x7fefd4f0000
	          end_va = 0x7fefd514fff
	       monitored = 0
	     entry_point = 0x7fefd4f9658
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 1987
	        start_va = 0x7fefd520000
	          end_va = 0x7fefd52efff
	       monitored = 0
	     entry_point = 0x7fefd521010
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 1988
	        start_va = 0x7fefd5d0000
	          end_va = 0x7fefd60cfff
	       monitored = 0
	     entry_point = 0x7fefd5d18f4
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 1989
	        start_va = 0x7fefd610000
	          end_va = 0x7fefd623fff
	       monitored = 0
	     entry_point = 0x7fefd6110e0
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 1990
	        start_va = 0x7fefd6d0000
	          end_va = 0x7fefd6defff
	       monitored = 0
	     entry_point = 0x7fefd6d1020
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 1991
	        start_va = 0x7fefd6e0000
	          end_va = 0x7fefd6f9fff
	       monitored = 0
	     entry_point = 0x7fefd6e1558
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 1992
	        start_va = 0x7fefd700000
	          end_va = 0x7fefd735fff
	       monitored = 0
	     entry_point = 0x7fefd701474
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 1993
	        start_va = 0x7fefd7e0000
	          end_va = 0x7fefd84bfff
	       monitored = 0
	     entry_point = 0x7fefd7e2780
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 1994
	        start_va = 0x7fefd850000
	          end_va = 0x7fefd9bcfff
	       monitored = 0
	     entry_point = 0x7fefd8510b4
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 1995
	        start_va = 0x7fefd9c0000
	          end_va = 0x7fefd9fafff
	       monitored = 0
	     entry_point = 0x7fefd9c1324
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 1996
	        start_va = 0x7fefda00000
	          end_va = 0x7fefdb2cfff
	       monitored = 0
	     entry_point = 0x7fefda4ed50
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 1997
	        start_va = 0x7fefdb30000
	          end_va = 0x7fefdbf8fff
	       monitored = 0
	     entry_point = 0x7fefdbaa874
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 1998
	        start_va = 0x7fefdc00000
	          end_va = 0x7fefdc0dfff
	       monitored = 0
	     entry_point = 0x7fefdc01080
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 1999
	        start_va = 0x7fefdc10000
	          end_va = 0x7fefdc17fff
	       monitored = 0
	     entry_point = 0x7fefdc11504
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2000
	        start_va = 0x7fefdca0000
	          end_va = 0x7fefdd06fff
	       monitored = 0
	     entry_point = 0x7fefdcab03c
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2001
	        start_va = 0x7fefdd10000
	          end_va = 0x7fefdd5cfff
	       monitored = 0
	     entry_point = 0x7fefdd11070
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2002
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefdd7efff
	       monitored = 0
	     entry_point = 0x7fefdd660e8
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2003
	        start_va = 0x7fefdd80000
	          end_va = 0x7fefdf82fff
	       monitored = 0
	     entry_point = 0x7fefdda3330
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2004
	        start_va = 0x7fefdf90000
	          end_va = 0x7fefdfe1fff
	       monitored = 0
	     entry_point = 0x7fefdf910d4
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 2005
	        start_va = 0x7fefdff0000
	          end_va = 0x7fefe01dfff
	       monitored = 0
	     entry_point = 0x7fefdff1010
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2006
	        start_va = 0x7fefe020000
	          end_va = 0x7fefe0fafff
	       monitored = 0
	     entry_point = 0x7fefe040760
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2007
	        start_va = 0x7fefe280000
	          end_va = 0x7fefe456fff
	       monitored = 0
	     entry_point = 0x7fefe281010
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 2008
	        start_va = 0x7fefe4e0000
	          end_va = 0x7fefe5e8fff
	       monitored = 0
	     entry_point = 0x7fefe4e1064
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2009
	        start_va = 0x7fefe850000
	          end_va = 0x7fefe8e8fff
	       monitored = 0
	     entry_point = 0x7fefe851c10
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2010
	        start_va = 0x7fefe8f0000
	          end_va = 0x7fefe9c6fff
	       monitored = 0
	     entry_point = 0x7fefe8f3274
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2011
	        start_va = 0x7feff930000
	          end_va = 0x7feff9cefff
	       monitored = 0
	     entry_point = 0x7feff9325a0
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2012
	        start_va = 0x7feffa00000
	          end_va = 0x7feffa00fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2013
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 2014
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 2015
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 2016
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 2017
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 2018
	        start_va = 0x7fffffd6000
	          end_va = 0x7fffffd7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd6000"
	        filename = ""

Region:
	              id = 2019
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 2020
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdafff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 2021
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffddfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 2022
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 2024
	        start_va = 0x7fef8210000
	          end_va = 0x7fef823bfff
	       monitored = 0
	     entry_point = 0x7fef8228194
	     region_type = mapped_file
	            name = "wmipcima.dll"
	        filename = "\\Windows\\System32\\wbem\\wmipcima.dll" (normalized: "c:\\windows\\system32\\wbem\\wmipcima.dll")

Region:
	              id = 2402
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2403
	        start_va = 0x7fefb120000
	          end_va = 0x7fefb146fff
	       monitored = 0
	     entry_point = 0x7fefb1298bc
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2404
	        start_va = 0x7fefb110000
	          end_va = 0x7fefb11afff
	       monitored = 0
	     entry_point = 0x7fefb111198
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2405
	        start_va = 0x7fefae90000
	          end_va = 0x7fefaea0fff
	       monitored = 0
	     entry_point = 0x7fefae916ac
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2406
	        start_va = 0x7fefae70000
	          end_va = 0x7fefae87fff
	       monitored = 0
	     entry_point = 0x7fefae71bf8
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2408
	        start_va = 0xa90000
	          end_va = 0xaa2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a90000"
	        filename = ""

Region:
	              id = 2409
	        start_va = 0xa70000
	          end_va = 0xa70fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll")

Region:
	              id = 2410
	        start_va = 0xa90000
	          end_va = 0xa96fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui")

Region:
	              id = 2411
	        start_va = 0xa70000
	          end_va = 0xa70fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll")

Region:
	              id = 2412
	        start_va = 0xa90000
	          end_va = 0xa96fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui")

Region:
	              id = 2413
	        start_va = 0xa70000
	          end_va = 0xa70fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll")

Region:
	              id = 2414
	        start_va = 0xa90000
	          end_va = 0xa96fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui")

Region:
	              id = 2415
	        start_va = 0xa70000
	          end_va = 0xa70fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll")

Region:
	              id = 2416
	        start_va = 0xa90000
	          end_va = 0xa96fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui")

Region:
	              id = 2417
	        start_va = 0x7fefcd40000
	          end_va = 0x7fefcd9afff
	       monitored = 0
	     entry_point = 0x7fefcd46940
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 2418
	        start_va = 0xe30000
	          end_va = 0xefffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e30000"
	        filename = ""

Region:
	              id = 2419
	        start_va = 0xa70000
	          end_va = 0xa72fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a70000"
	        filename = ""

Region:
	              id = 2420
	        start_va = 0xa90000
	          end_va = 0xa94fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a90000"
	        filename = ""

Region:
	              id = 2941
	        start_va = 0xa90000
	          end_va = 0xae1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "advapi32.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\advapi32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32.dll.mui")

Region:
	              id = 2942
	        start_va = 0x1170000
	          end_va = 0x11effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001170000"
	        filename = ""

Region:
	              id = 2943
	        start_va = 0x7fefaf50000
	          end_va = 0x7fefaf5afff
	       monitored = 0
	     entry_point = 0x7fefaf546ec
	     region_type = mapped_file
	            name = "perfos.dll"
	        filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll")

Region:
	              id = 2944
	        start_va = 0x1c0000
	          end_va = 0x1cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2945
	        start_va = 0x11f0000
	          end_va = 0x12effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011f0000"
	        filename = ""

Region:
	              id = 2946
	        start_va = 0x12f0000
	          end_va = 0x13effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000012f0000"
	        filename = ""

Region:
	              id = 2947
	        start_va = 0xa70000
	          end_va = 0xa72fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a70000"
	        filename = ""

Region:
	              id = 2948
	        start_va = 0x1480000
	          end_va = 0x14fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001480000"
	        filename = ""

Region:
	              id = 2949
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""


Thread:
	id = 53
	os_tid = 0xff4


Thread:
	id = 54
	os_tid = 0xd2c


Thread:
	id = 55
	os_tid = 0xd28


Thread:
	id = 56
	os_tid = 0xd24


Thread:
	id = 57
	os_tid = 0xd20


Thread:
	id = 58
	os_tid = 0xd18


Thread:
	id = 59
	os_tid = 0xd14


Thread:
	id = 60
	os_tid = 0xd10


Thread:
	id = 141
	os_tid = 0xd44


Thread:
	id = 158
	os_tid = 0xd98


Process:
	id = "5"
	image_name = "wmiprvse.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
	page_root = "0x5d01a000"
	os_pid = "0x420"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "rpc_server"
	parent_id = "3"
	os_parent_pid = "0x248"
	cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d1f9" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 2446
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2447
	        start_va = 0x20000
	          end_va = 0x20fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2448
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2449
	        start_va = 0x40000
	          end_va = 0x40fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2450
	        start_va = 0x50000
	          end_va = 0xb6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2451
	        start_va = 0xc0000
	          end_va = 0x17ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000c0000"
	        filename = ""

Region:
	              id = 2452
	        start_va = 0x180000
	          end_va = 0x180fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 2453
	        start_va = 0x190000
	          end_va = 0x194fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "user32.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")

Region:
	              id = 2454
	        start_va = 0x1a0000
	          end_va = 0x1a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2455
	        start_va = 0x1b0000
	          end_va = 0x22ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2456
	        start_va = 0x230000
	          end_va = 0x230fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000230000"
	        filename = ""

Region:
	              id = 2457
	        start_va = 0x240000
	          end_va = 0x240fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000240000"
	        filename = ""

Region:
	              id = 2458
	        start_va = 0x2e0000
	          end_va = 0x3dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002e0000"
	        filename = ""

Region:
	              id = 2459
	        start_va = 0x3e0000
	          end_va = 0x4dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003e0000"
	        filename = ""

Region:
	              id = 2460
	        start_va = 0x510000
	          end_va = 0x51ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 2461
	        start_va = 0x520000
	          end_va = 0x6a7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000520000"
	        filename = ""

Region:
	              id = 2462
	        start_va = 0x6b0000
	          end_va = 0x830fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006b0000"
	        filename = ""

Region:
	              id = 2463
	        start_va = 0x840000
	          end_va = 0xb0efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2464
	        start_va = 0xbd0000
	          end_va = 0xc4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000bd0000"
	        filename = ""

Region:
	              id = 2465
	        start_va = 0xca0000
	          end_va = 0xd1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ca0000"
	        filename = ""

Region:
	              id = 2466
	        start_va = 0xe20000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 2467
	        start_va = 0xea0000
	          end_va = 0xf1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 2468
	        start_va = 0xf90000
	          end_va = 0x100ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f90000"
	        filename = ""

Region:
	              id = 2469
	        start_va = 0x1010000
	          end_va = 0x108ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001010000"
	        filename = ""

Region:
	              id = 2470
	        start_va = 0x1090000
	          end_va = 0x118ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001090000"
	        filename = ""

Region:
	              id = 2471
	        start_va = 0x11b0000
	          end_va = 0x122ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000011b0000"
	        filename = ""

Region:
	              id = 2472
	        start_va = 0x1270000
	          end_va = 0x12effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001270000"
	        filename = ""

Region:
	              id = 2473
	        start_va = 0x14c0000
	          end_va = 0x153ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000014c0000"
	        filename = ""

Region:
	              id = 2474
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 0
	     entry_point = 0x774d5340
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2475
	        start_va = 0x775e0000
	          end_va = 0x776d9fff
	       monitored = 0
	     entry_point = 0x775fa2c8
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2476
	        start_va = 0x776e0000
	          end_va = 0x77888fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2477
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2478
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2479
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2480
	        start_va = 0x13fdc0000
	          end_va = 0x13fe2bfff
	       monitored = 0
	     entry_point = 0x13fdfb450
	     region_type = mapped_file
	            name = "wmiprvse.exe"
	        filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe")

Region:
	              id = 2481
	        start_va = 0x7fef0d10000
	          end_va = 0x7fef0d5dfff
	       monitored = 0
	     entry_point = 0x7fef0d11198
	     region_type = mapped_file
	            name = "pdh.dll"
	        filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll")

Region:
	              id = 2482
	        start_va = 0x7fef1200000
	          end_va = 0x7fef1224fff
	       monitored = 0
	     entry_point = 0x7fef1218d6c
	     region_type = mapped_file
	            name = "wmiperfclass.dll"
	        filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll")

Region:
	              id = 2483
	        start_va = 0x7fef4da0000
	          end_va = 0x7fef4db1fff
	       monitored = 0
	     entry_point = 0x7fef4da89d0
	     region_type = mapped_file
	            name = "ncobjapi.dll"
	        filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")

Region:
	              id = 2484
	        start_va = 0x7fef4f60000
	          end_va = 0x7fef4f80fff
	       monitored = 0
	     entry_point = 0x7fef4f703b0
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")

Region:
	              id = 2485
	        start_va = 0x7fef5000000
	          end_va = 0x7fef5012fff
	       monitored = 0
	     entry_point = 0x7fef5001d80
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 2486
	        start_va = 0x7fef52e0000
	          end_va = 0x7fef52edfff
	       monitored = 0
	     entry_point = 0x7fef52e5500
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 2487
	        start_va = 0x7fef52f0000
	          end_va = 0x7fef5316fff
	       monitored = 0
	     entry_point = 0x7fef52f11a0
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll")

Region:
	              id = 2488
	        start_va = 0x7fef5320000
	          end_va = 0x7fef53f2fff
	       monitored = 0
	     entry_point = 0x7fef5398b00
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 2489
	        start_va = 0x7fef55a0000
	          end_va = 0x7fef5616fff
	       monitored = 0
	     entry_point = 0x7fef55de7f0
	     region_type = mapped_file
	            name = "wbemcomn2.dll"
	        filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll")

Region:
	              id = 2490
	        start_va = 0x7fef8130000
	          end_va = 0x7fef81b5fff
	       monitored = 0
	     entry_point = 0x7fef813ffd0
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")

Region:
	              id = 2491
	        start_va = 0x7fef81c0000
	          end_va = 0x7fef81fbfff
	       monitored = 0
	     entry_point = 0x7fef81e5aa8
	     region_type = mapped_file
	            name = "wmiprov.dll"
	        filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll")

Region:
	              id = 2492
	        start_va = 0x7fefb6b0000
	          end_va = 0x7fefb6dcfff
	       monitored = 0
	     entry_point = 0x7fefb6b1010
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 2493
	        start_va = 0x7fefcc20000
	          end_va = 0x7fefcc66fff
	       monitored = 0
	     entry_point = 0x7fefcc21064
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2494
	        start_va = 0x7fefcf20000
	          end_va = 0x7fefcf37fff
	       monitored = 0
	     entry_point = 0x7fefcf23b48
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2495
	        start_va = 0x7fefd090000
	          end_va = 0x7fefd0b1fff
	       monitored = 0
	     entry_point = 0x7fefd095d30
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 2496
	        start_va = 0x7fefd150000
	          end_va = 0x7fefd1bcfff
	       monitored = 0
	     entry_point = 0x7fefd151010
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 2497
	        start_va = 0x7fefd520000
	          end_va = 0x7fefd52efff
	       monitored = 0
	     entry_point = 0x7fefd521010
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2498
	        start_va = 0x7fefd610000
	          end_va = 0x7fefd623fff
	       monitored = 0
	     entry_point = 0x7fefd6110e0
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 2499
	        start_va = 0x7fefd7e0000
	          end_va = 0x7fefd84bfff
	       monitored = 0
	     entry_point = 0x7fefd7e2780
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2500
	        start_va = 0x7fefda00000
	          end_va = 0x7fefdb2cfff
	       monitored = 0
	     entry_point = 0x7fefda4ed50
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2501
	        start_va = 0x7fefdb30000
	          end_va = 0x7fefdbf8fff
	       monitored = 0
	     entry_point = 0x7fefdbaa874
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 2502
	        start_va = 0x7fefdc00000
	          end_va = 0x7fefdc0dfff
	       monitored = 0
	     entry_point = 0x7fefdc01080
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 2503
	        start_va = 0x7fefdc10000
	          end_va = 0x7fefdc17fff
	       monitored = 0
	     entry_point = 0x7fefdc11504
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2504
	        start_va = 0x7fefdca0000
	          end_va = 0x7fefdd06fff
	       monitored = 0
	     entry_point = 0x7fefdcab03c
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2505
	        start_va = 0x7fefdd10000
	          end_va = 0x7fefdd5cfff
	       monitored = 0
	     entry_point = 0x7fefdd11070
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2506
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefdd7efff
	       monitored = 0
	     entry_point = 0x7fefdd660e8
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2507
	        start_va = 0x7fefdd80000
	          end_va = 0x7fefdf82fff
	       monitored = 0
	     entry_point = 0x7fefdda3330
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2508
	        start_va = 0x7fefdf90000
	          end_va = 0x7fefdfe1fff
	       monitored = 0
	     entry_point = 0x7fefdf910d4
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 2509
	        start_va = 0x7fefdff0000
	          end_va = 0x7fefe01dfff
	       monitored = 0
	     entry_point = 0x7fefdff1010
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2510
	        start_va = 0x7fefe020000
	          end_va = 0x7fefe0fafff
	       monitored = 0
	     entry_point = 0x7fefe040760
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2511
	        start_va = 0x7fefe4e0000
	          end_va = 0x7fefe5e8fff
	       monitored = 0
	     entry_point = 0x7fefe4e1064
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2512
	        start_va = 0x7fefe850000
	          end_va = 0x7fefe8e8fff
	       monitored = 0
	     entry_point = 0x7fefe851c10
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2513
	        start_va = 0x7fefe8f0000
	          end_va = 0x7fefe9c6fff
	       monitored = 0
	     entry_point = 0x7fefe8f3274
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2514
	        start_va = 0x7feff930000
	          end_va = 0x7feff9cefff
	       monitored = 0
	     entry_point = 0x7feff9325a0
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2515
	        start_va = 0x7feffa00000
	          end_va = 0x7feffa00fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2516
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 2517
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 2518
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 2519
	        start_va = 0x7fffffd3000
	          end_va = 0x7fffffd4fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd3000"
	        filename = ""

Region:
	              id = 2520
	        start_va = 0x7fffffd5000
	          end_va = 0x7fffffd6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd5000"
	        filename = ""

Region:
	              id = 2521
	        start_va = 0x7fffffd7000
	          end_va = 0x7fffffd7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd7000"
	        filename = ""

Region:
	              id = 2522
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 2523
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdbfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 2524
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffddfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 2525
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""


Thread:
	id = 61
	os_tid = 0xfac


Thread:
	id = 62
	os_tid = 0x700


Thread:
	id = 63
	os_tid = 0x6bc


Thread:
	id = 64
	os_tid = 0x72c


Thread:
	id = 65
	os_tid = 0x680


Thread:
	id = 66
	os_tid = 0x71c


Thread:
	id = 67
	os_tid = 0x3fc


Thread:
	id = 68
	os_tid = 0x118


Process:
	id = "6"
	image_name = "85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	filename = "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	page_root = "0x2265e000"
	os_pid = "0xac4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xf44"
	cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe\""
	cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\"
	os_username = "Q9IATRKPRH\\kEecfMwgj"
	bitness = "32"
	os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2051
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2052
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2053
	        start_va = 0x40000
	          end_va = 0x40fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2054
	        start_va = 0x50000
	          end_va = 0x53fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 2055
	        start_va = 0x60000
	          end_va = 0x60fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 2056
	        start_va = 0x120000
	          end_va = 0x1fbfff
	       monitored = 1
	     entry_point = 0x1dfcf2
	     region_type = mapped_file
	            name = "85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	        filename = "\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")

Region:
	              id = 2057
	        start_va = 0x200000
	          end_va = 0x23ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2058
	        start_va = 0x320000
	          end_va = 0x41ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000320000"
	        filename = ""

Region:
	              id = 2059
	        start_va = 0x776e0000
	          end_va = 0x77888fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2060
	        start_va = 0x778c0000
	          end_va = 0x77a3ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2061
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 2062
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 2063
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 2064
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 2065
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2066
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2067
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""


Thread:
	id = 72
	os_tid = 0xac0


Process:
	id = "7"
	image_name = "85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	filename = "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	page_root = "0x129e0000"
	os_pid = "0xabc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xf44"
	cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe\""
	cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\"
	os_username = "Q9IATRKPRH\\kEecfMwgj"
	bitness = "32"
	os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2068
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2069
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2070
	        start_va = 0x40000
	          end_va = 0x40fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2071
	        start_va = 0x50000
	          end_va = 0x53fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 2072
	        start_va = 0x60000
	          end_va = 0x60fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000060000"
	        filename = ""

Region:
	              id = 2073
	        start_va = 0x120000
	          end_va = 0x1fbfff
	       monitored = 1
	     entry_point = 0x1dfcf2
	     region_type = mapped_file
	            name = "85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	        filename = "\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")

Region:
	              id = 2074
	        start_va = 0x280000
	          end_va = 0x2bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000280000"
	        filename = ""

Region:
	              id = 2075
	        start_va = 0x440000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 2076
	        start_va = 0x776e0000
	          end_va = 0x77888fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2077
	        start_va = 0x778c0000
	          end_va = 0x77a3ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2078
	        start_va = 0x7efb0000
	          end_va = 0x7efd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efb0000"
	        filename = ""

Region:
	              id = 2079
	        start_va = 0x7efdb000
	          end_va = 0x7efddfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdb000"
	        filename = ""

Region:
	              id = 2080
	        start_va = 0x7efde000
	          end_va = 0x7efdefff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efde000"
	        filename = ""

Region:
	              id = 2081
	        start_va = 0x7efdf000
	          end_va = 0x7efdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efdf000"
	        filename = ""

Region:
	              id = 2082
	        start_va = 0x7efe0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2083
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2084
	        start_va = 0x7fff0000
	          end_va = 0x7fffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2085
	        start_va = 0x400000
	          end_va = 0x43bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2086
	        start_va = 0x540000
	          end_va = 0x7affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 2087
	        start_va = 0x751a0000
	          end_va = 0x751defff
	       monitored = 0
	     entry_point = 0x751ce088
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2088
	        start_va = 0x75140000
	          end_va = 0x7519bfff
	       monitored = 0
	     entry_point = 0x7517f9f4
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2089
	        start_va = 0x75130000
	          end_va = 0x75137fff
	       monitored = 0
	     entry_point = 0x751320f8
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2090
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 0
	     entry_point = 0x774d5340
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2091
	        start_va = 0x772b0000
	          end_va = 0x773bffff
	       monitored = 0
	     entry_point = 0x772c3283
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2092
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 0
	     entry_point = 0x774d5340
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2093
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000774c0000"
	        filename = ""

Region:
	              id = 2094
	        start_va = 0x775e0000
	          end_va = 0x776d9fff
	       monitored = 0
	     entry_point = 0x775fa2c8
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2095
	        start_va = 0x775e0000
	          end_va = 0x776d9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000775e0000"
	        filename = ""

Region:
	              id = 2096
	        start_va = 0x7b0000
	          end_va = 0xa9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007b0000"
	        filename = ""

Region:
	              id = 2097
	        start_va = 0x752a0000
	          end_va = 0x752e9fff
	       monitored = 1
	     entry_point = 0x752a2e54
	     region_type = mapped_file
	            name = "mscoree.dll"
	        filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")

Region:
	              id = 2098
	        start_va = 0x772b0000
	          end_va = 0x773bffff
	       monitored = 0
	     entry_point = 0x772c3283
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2099
	        start_va = 0x773e0000
	          end_va = 0x77426fff
	       monitored = 0
	     entry_point = 0x773e74c1
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2100
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2101
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2102
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2103
	        start_va = 0x70000
	          end_va = 0xd6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2104
	        start_va = 0x540000
	          end_va = 0x6dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 2105
	        start_va = 0x730000
	          end_va = 0x7affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 2106
	        start_va = 0x200000
	          end_va = 0x26ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2107
	        start_va = 0x77180000
	          end_va = 0x7721ffff
	       monitored = 0
	     entry_point = 0x771949e5
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 2108
	        start_va = 0x76b90000
	          end_va = 0x76c3bfff
	       monitored = 0
	     entry_point = 0x76b9a472
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2109
	        start_va = 0x77490000
	          end_va = 0x774a8fff
	       monitored = 0
	     entry_point = 0x77494975
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 2110
	        start_va = 0x769e0000
	          end_va = 0x76acffff
	       monitored = 0
	     entry_point = 0x769f0569
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 2111
	        start_va = 0x75410000
	          end_va = 0x7546ffff
	       monitored = 0
	     entry_point = 0x7542a3b3
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 2112
	        start_va = 0x75400000
	          end_va = 0x7540bfff
	       monitored = 0
	     entry_point = 0x754010e1
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 2113
	        start_va = 0xe0000
	          end_va = 0x11ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2114
	        start_va = 0x75210000
	          end_va = 0x7529cfff
	       monitored = 1
	     entry_point = 0x75222860
	     region_type = mapped_file
	            name = "mscoreei.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")

Region:
	              id = 2115
	        start_va = 0x73430000
	          end_va = 0x73432fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "api-ms-win-core-synch-l1-2-0.dll"
	        filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll")

Region:
	              id = 2116
	        start_va = 0x76850000
	          end_va = 0x768a6fff
	       monitored = 0
	     entry_point = 0x76869ba6
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 2120
	        start_va = 0x76270000
	          end_va = 0x762fffff
	       monitored = 0
	     entry_point = 0x76286343
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 2121
	        start_va = 0x766d0000
	          end_va = 0x767cffff
	       monitored = 0
	     entry_point = 0x766eb6ed
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 2122
	        start_va = 0x77890000
	          end_va = 0x77899fff
	       monitored = 0
	     entry_point = 0x778936a0
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")

Region:
	              id = 2123
	        start_va = 0x76300000
	          end_va = 0x7639cfff
	       monitored = 0
	     entry_point = 0x76333fd7
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")

Region:
	              id = 2124
	        start_va = 0x20000
	          end_va = 0x3dfff
	       monitored = 0
	     entry_point = 0x3158f
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2125
	        start_va = 0x540000
	          end_va = 0x6c7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000540000"
	        filename = ""

Region:
	              id = 2126
	        start_va = 0x6d0000
	          end_va = 0x6dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006d0000"
	        filename = ""

Region:
	              id = 2127
	        start_va = 0x20000
	          end_va = 0x3dfff
	       monitored = 0
	     entry_point = 0x3158f
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2128
	        start_va = 0x77430000
	          end_va = 0x7748ffff
	       monitored = 0
	     entry_point = 0x7744158f
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2129
	        start_va = 0x77050000
	          end_va = 0x7711bfff
	       monitored = 0
	     entry_point = 0x7705168b
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")

Region:
	              id = 2130
	        start_va = 0x7b0000
	          end_va = 0x930fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007b0000"
	        filename = ""

Region:
	              id = 2131
	        start_va = 0x9a0000
	          end_va = 0xa9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000009a0000"
	        filename = ""

Region:
	              id = 2132
	        start_va = 0xaa0000
	          end_va = 0x1e9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000aa0000"
	        filename = ""

Region:
	              id = 2133
	        start_va = 0x20000
	          end_va = 0x20fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2134
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2135
	        start_va = 0x2c0000
	          end_va = 0x397fff
	       monitored = 1
	     entry_point = 0x37fcf2
	     region_type = mapped_file
	            name = "85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	        filename = "\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")

Region:
	              id = 2136
	        start_va = 0x2c0000
	          end_va = 0x397fff
	       monitored = 1
	     entry_point = 0x37fcf2
	     region_type = mapped_file
	            name = "85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe"
	        filename = "\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")

Region:
	              id = 2137
	        start_va = 0x74400000
	          end_va = 0x74408fff
	       monitored = 0
	     entry_point = 0x74401220
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2138
	        start_va = 0x723c0000
	          end_va = 0x72b6efff
	       monitored = 1
	     entry_point = 0x723dd0d0
	     region_type = mapped_file
	            name = "clr.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")

Region:
	              id = 2139
	        start_va = 0x723c0000
	          end_va = 0x72b6efff
	       monitored = 1
	     entry_point = 0x723dd0d0
	     region_type = mapped_file
	            name = "clr.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")

Region:
	              id = 2140
	        start_va = 0x723c0000
	          end_va = 0x72b6efff
	       monitored = 1
	     entry_point = 0x723dd0d0
	     region_type = mapped_file
	            name = "clr.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")

Region:
	              id = 2141
	        start_va = 0x751f0000
	          end_va = 0x75203fff
	       monitored = 0
	     entry_point = 0x751fac00
	     region_type = mapped_file
	            name = "vcruntime140_clr0400.dll"
	        filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll")

Region:
	              id = 2142
	        start_va = 0x72310000
	          end_va = 0x723bafff
	       monitored = 0
	     entry_point = 0x723a5f20
	     region_type = mapped_file
	            name = "ucrtbase_clr0400.dll"
	        filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll")

Region:
	              id = 2143
	        start_va = 0xe0000
	          end_va = 0xe0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2144
	        start_va = 0x110000
	          end_va = 0x11ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 2145
	        start_va = 0xf0000
	          end_va = 0xfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2146
	        start_va = 0x100000
	          end_va = 0x10ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 2147
	        start_va = 0x200000
	          end_va = 0x20ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2148
	        start_va = 0x230000
	          end_va = 0x26ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000230000"
	        filename = ""

Region:
	              id = 2149
	        start_va = 0x210000
	          end_va = 0x21ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000210000"
	        filename = ""

Region:
	              id = 2150
	        start_va = 0x220000
	          end_va = 0x22ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000220000"
	        filename = ""

Region:
	              id = 2151
	        start_va = 0x270000
	          end_va = 0x27ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000270000"
	        filename = ""

Region:
	              id = 2152
	        start_va = 0x2c0000
	          end_va = 0x2c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002c0000"
	        filename = ""

Region:
	              id = 2153
	        start_va = 0x2d0000
	          end_va = 0x2d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002d0000"
	        filename = ""

Region:
	              id = 2154
	        start_va = 0x1ea0000
	          end_va = 0x200ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 2155
	        start_va = 0x2010000
	          end_va = 0x222ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2156
	        start_va = 0x3c0000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003c0000"
	        filename = ""

Region:
	              id = 2157
	        start_va = 0x2030000
	          end_va = 0x212ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002030000"
	        filename = ""

Region:
	              id = 2158
	        start_va = 0x21f0000
	          end_va = 0x222ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021f0000"
	        filename = ""

Region:
	              id = 2159
	        start_va = 0x7efd8000
	          end_va = 0x7efdafff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd8000"
	        filename = ""

Region:
	              id = 2160
	        start_va = 0x2e0000
	          end_va = 0x2effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002e0000"
	        filename = ""

Region:
	              id = 2161
	        start_va = 0x2230000
	          end_va = 0x422ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002230000"
	        filename = ""

Region:
	              id = 2162
	        start_va = 0x2e0000
	          end_va = 0x37ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002e0000"
	        filename = ""

Region:
	              id = 2163
	        start_va = 0x6f0000
	          end_va = 0x72ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 2164
	        start_va = 0x1ea0000
	          end_va = 0x1f9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 2165
	        start_va = 0x1fd0000
	          end_va = 0x200ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fd0000"
	        filename = ""

Region:
	              id = 2166
	        start_va = 0x7efd5000
	          end_va = 0x7efd7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efd5000"
	        filename = ""

Region:
	              id = 2167
	        start_va = 0x42c0000
	          end_va = 0x42fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000042c0000"
	        filename = ""

Region:
	              id = 2168
	        start_va = 0x43c0000
	          end_va = 0x44bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000043c0000"
	        filename = ""

Region:
	              id = 2169
	        start_va = 0x7efad000
	          end_va = 0x7efaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efad000"
	        filename = ""

Region:
	              id = 2170
	        start_va = 0x44c0000
	          end_va = 0x478efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2171
	        start_va = 0x70f00000
	          end_va = 0x7230afff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mscorlib.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll")

Region:
	              id = 2172
	        start_va = 0x763d0000
	          end_va = 0x7652bfff
	       monitored = 0
	     entry_point = 0x7641ba3d
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 2173
	        start_va = 0x74320000
	          end_va = 0x7439ffff
	       monitored = 0
	     entry_point = 0x743337c9
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")

Region:
	              id = 2174
	        start_va = 0x4790000
	          end_va = 0x488ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004790000"
	        filename = ""

Region:
	              id = 2175
	        start_va = 0x4890000
	          end_va = 0x496efff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004890000"
	        filename = ""

Region:
	              id = 2176
	        start_va = 0x380000
	          end_va = 0x38ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000380000"
	        filename = ""

Region:
	              id = 2177
	        start_va = 0x390000
	          end_va = 0x39ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000390000"
	        filename = ""

Region:
	              id = 2178
	        start_va = 0x70ef0000
	          end_va = 0x70ef2fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "api-ms-win-core-xstate-l2-1-0.dll"
	        filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll")

Region:
	              id = 2179
	        start_va = 0x70340000
	          end_va = 0x703c8fff
	       monitored = 1
	     entry_point = 0x70341130
	     region_type = mapped_file
	            name = "clrjit.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")

Region:
	              id = 2180
	        start_va = 0x76ad0000
	          end_va = 0x76b5efff
	       monitored = 0
	     entry_point = 0x76ad3fb1
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 2181
	        start_va = 0x3a0000
	          end_va = 0x3affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003a0000"
	        filename = ""

Region:
	              id = 2182
	        start_va = 0x70410000
	          end_va = 0x70e64fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll")

Region:
	              id = 2183
	        start_va = 0x3b0000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2184
	        start_va = 0x70190000
	          end_va = 0x70332fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.drawing.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\system.drawing.ni.dll")

Region:
	              id = 2185
	        start_va = 0x6dcd0000
	          end_va = 0x6eb35fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.windows.forms.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\system.windows.forms.ni.dll")

Region:
	              id = 2186
	        start_va = 0x3b0000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2187
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2188
	        start_va = 0x3b0000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2189
	        start_va = 0x3b0000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2190
	        start_va = 0x3b0000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2191
	        start_va = 0x3b0000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2192
	        start_va = 0x3b0000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2193
	        start_va = 0x3b0000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2194
	        start_va = 0x3b0000
	          end_va = 0x3bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2195
	        start_va = 0x6eb40000
	          end_va = 0x6f357fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.core.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll")

Region:
	              id = 2196
	        start_va = 0x70080000
	          end_va = 0x70184fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.configuration.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll")

Region:
	              id = 2197
	        start_va = 0x6f900000
	          end_va = 0x70073fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.xml.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll")

Region:
	              id = 2198
	        start_va = 0x70ed0000
	          end_va = 0x70ee2fff
	       monitored = 1
	     entry_point = 0x70edd900
	     region_type = mapped_file
	            name = "nlssorting.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")

Region:
	              id = 2199
	        start_va = 0x4970000
	          end_va = 0x4c41fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nlp"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp")

Region:
	              id = 2200
	        start_va = 0x755b0000
	          end_va = 0x761f9fff
	       monitored = 0
	     entry_point = 0x75631601
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")

Region:
	              id = 2201
	        start_va = 0x3b0000
	          end_va = 0x3b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003b0000"
	        filename = ""

Region:
	              id = 2202
	        start_va = 0x744c0000
	          end_va = 0x744cafff
	       monitored = 0
	     entry_point = 0x744c1992
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")

Region:
	              id = 2203
	        start_va = 0x4c50000
	          end_va = 0x4d7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c50000"
	        filename = ""

Region:
	              id = 2204
	        start_va = 0x70eb0000
	          end_va = 0x70ec6fff
	       monitored = 0
	     entry_point = 0x70eb35fa
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2205
	        start_va = 0x74190000
	          end_va = 0x741a6fff
	       monitored = 0
	     entry_point = 0x74193573
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 2206
	        start_va = 0x940000
	          end_va = 0x97bfff
	       monitored = 0
	     entry_point = 0x94128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 2207
	        start_va = 0x940000
	          end_va = 0x97bfff
	       monitored = 0
	     entry_point = 0x94128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 2208
	        start_va = 0x940000
	          end_va = 0x97bfff
	       monitored = 0
	     entry_point = 0x94128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 2209
	        start_va = 0x940000
	          end_va = 0x97bfff
	       monitored = 0
	     entry_point = 0x94128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 2210
	        start_va = 0x940000
	          end_va = 0x97bfff
	       monitored = 0
	     entry_point = 0x94128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 2211
	        start_va = 0x74150000
	          end_va = 0x7418afff
	       monitored = 0
	     entry_point = 0x7415128d
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 2213
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2214
	        start_va = 0x940000
	          end_va = 0x94ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000940000"
	        filename = ""

Region:
	              id = 2215
	        start_va = 0x742e0000
	          end_va = 0x742f2fff
	       monitored = 0
	     entry_point = 0x742e1d3f
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")

Region:
	              id = 2216
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2217
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2218
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2219
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2220
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2221
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2222
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2223
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2224
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2225
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2226
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2227
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2228
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2229
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2230
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2231
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2232
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2233
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2234
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2235
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2236
	        start_va = 0x6f710000
	          end_va = 0x6f8f1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "microsoft.visualbasic.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\a891970b44db9e340c3ef3efa95b793c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\a891970b44db9e340c3ef3efa95b793c\\microsoft.visualbasic.ni.dll")

Region:
	              id = 2237
	        start_va = 0x6e0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2238
	        start_va = 0x940000
	          end_va = 0x94ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000940000"
	        filename = ""

Region:
	              id = 2309
	        start_va = 0x76ca0000
	          end_va = 0x76ca4fff
	       monitored = 0
	     entry_point = 0x76ca1438
	     region_type = mapped_file
	            name = "psapi.dll"
	        filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")

Region:
	              id = 2310
	        start_va = 0x2180000
	          end_va = 0x21bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002180000"
	        filename = ""

Region:
	              id = 2311
	        start_va = 0x4ec0000
	          end_va = 0x4fbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004ec0000"
	        filename = ""

Region:
	              id = 2312
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 2313
	        start_va = 0x74300000
	          end_va = 0x7430dfff
	       monitored = 0
	     entry_point = 0x74301235
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")

Region:
	              id = 2314
	        start_va = 0x47d0000
	          end_va = 0x480ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000047d0000"
	        filename = ""

Region:
	              id = 2315
	        start_va = 0x4850000
	          end_va = 0x488ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004850000"
	        filename = ""

Region:
	              id = 2316
	        start_va = 0x5030000
	          end_va = 0x512ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005030000"
	        filename = ""

Region:
	              id = 2317
	        start_va = 0x7efa7000
	          end_va = 0x7efa9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa7000"
	        filename = ""

Region:
	              id = 2318
	        start_va = 0x6e0000
	          end_va = 0x6e0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2319
	        start_va = 0x4330000
	          end_va = 0x436ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004330000"
	        filename = ""

Region:
	              id = 2320
	        start_va = 0x5260000
	          end_va = 0x535ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005260000"
	        filename = ""

Region:
	              id = 2321
	        start_va = 0x7efa4000
	          end_va = 0x7efa6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa4000"
	        filename = ""

Region:
	              id = 2322
	        start_va = 0x76530000
	          end_va = 0x765b2fff
	       monitored = 0
	     entry_point = 0x765323d2
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2323
	        start_va = 0x940000
	          end_va = 0x940fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000940000"
	        filename = ""

Region:
	              id = 2324
	        start_va = 0x6f3e0000
	          end_va = 0x6f410fff
	       monitored = 1
	     entry_point = 0x6f3e12d7
	     region_type = mapped_file
	            name = "wbemdisp.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.dll")

Region:
	              id = 2325
	        start_va = 0x6f380000
	          end_va = 0x6f3dbfff
	       monitored = 0
	     entry_point = 0x6f3a2b48
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 2326
	        start_va = 0x76200000
	          end_va = 0x76234fff
	       monitored = 0
	     entry_point = 0x7620145d
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2327
	        start_va = 0x774b0000
	          end_va = 0x774b5fff
	       monitored = 0
	     entry_point = 0x774b1782
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")

Region:
	              id = 2328
	        start_va = 0x4230000
	          end_va = 0x42bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004230000"
	        filename = ""

Region:
	              id = 2329
	        start_va = 0x70e70000
	          end_va = 0x70e7afff
	       monitored = 0
	     entry_point = 0x70e752a0
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 2330
	        start_va = 0x6d0e0000
	          end_va = 0x6d140fff
	       monitored = 0
	     entry_point = 0x6d11bf40
	     region_type = mapped_file
	            name = "wbemcomn2.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn2.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn2.dll")

Region:
	              id = 2331
	        start_va = 0x6f360000
	          end_va = 0x6f379fff
	       monitored = 0
	     entry_point = 0x6f3703d0
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll")

Region:
	              id = 2332
	        start_va = 0x70400000
	          end_va = 0x7040efff
	       monitored = 0
	     entry_point = 0x704093d0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 2333
	        start_va = 0x4d80000
	          end_va = 0x4e7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d80000"
	        filename = ""

Region:
	              id = 2334
	        start_va = 0x6d030000
	          end_va = 0x6d0d5fff
	       monitored = 0
	     entry_point = 0x6d09a2f0
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 2335
	        start_va = 0x6d010000
	          end_va = 0x6d027fff
	       monitored = 0
	     entry_point = 0x6d011335
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll")

Region:
	              id = 2336
	        start_va = 0x72ce0000
	          end_va = 0x72d3efff
	       monitored = 0
	     entry_point = 0x72ce2134
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")

Region:
	              id = 2337
	        start_va = 0x950000
	          end_va = 0x95efff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wbemdisp.tlb"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.tlb")

Region:
	              id = 2338
	        start_va = 0x4c50000
	          end_va = 0x4d0ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2339
	        start_va = 0x4d40000
	          end_va = 0x4d7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d40000"
	        filename = ""

Region:
	              id = 2340
	        start_va = 0x6cfd0000
	          end_va = 0x6d004fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "custommarshalers.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\CustomMarshalers\\0df8ec76525d72c37f86b6d2ab717e84\\CustomMarshalers.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\custommarshalers\\0df8ec76525d72c37f86b6d2ab717e84\\custommarshalers.ni.dll")

Region:
	              id = 2341
	        start_va = 0x6cfb0000
	          end_va = 0x6cfc7fff
	       monitored = 1
	     entry_point = 0x6cfb58de
	     region_type = mapped_file
	            name = "custommarshalers.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll")

Region:
	              id = 2344
	        start_va = 0x960000
	          end_va = 0x978fff
	       monitored = 1
	     entry_point = 0x9658de
	     region_type = mapped_file
	            name = "custommarshalers.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll")

Region:
	              id = 2345
	        start_va = 0x960000
	          end_va = 0x978fff
	       monitored = 1
	     entry_point = 0x9658de
	     region_type = mapped_file
	            name = "custommarshalers.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll")

Region:
	              id = 2346
	        start_va = 0x960000
	          end_va = 0x978fff
	       monitored = 1
	     entry_point = 0x9658de
	     region_type = mapped_file
	            name = "custommarshalers.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll")

Region:
	              id = 2347
	        start_va = 0x960000
	          end_va = 0x978fff
	       monitored = 1
	     entry_point = 0x9658de
	     region_type = mapped_file
	            name = "custommarshalers.dll"
	        filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll")

Region:
	              id = 2348
	        start_va = 0x960000
	          end_va = 0x96ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000960000"
	        filename = ""

Region:
	              id = 2351
	        start_va = 0x970000
	          end_va = 0x973fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "stdole2.tlb"
	        filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")

Region:
	              id = 2352
	        start_va = 0x6f550000
	          end_va = 0x6f67ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.management.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll")

Region:
	              id = 2353
	        start_va = 0x980000
	          end_va = 0x98ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000980000"
	        filename = ""

Region:
	              id = 2354
	        start_va = 0x2130000
	          end_va = 0x216ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002130000"
	        filename = ""

Region:
	              id = 2355
	        start_va = 0x5360000
	          end_va = 0x545ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005360000"
	        filename = ""

Region:
	              id = 2356
	        start_va = 0x7efa1000
	          end_va = 0x7efa3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efa1000"
	        filename = ""

Region:
	              id = 2357
	        start_va = 0x7ef50000
	          end_va = 0x7ef9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef50000"
	        filename = ""

Region:
	              id = 2358
	        start_va = 0x7ef40000
	          end_va = 0x7ef4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef40000"
	        filename = ""

Region:
	              id = 2359
	        start_va = 0x5220000
	          end_va = 0x525ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005220000"
	        filename = ""

Region:
	              id = 2360
	        start_va = 0x5620000
	          end_va = 0x571ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005620000"
	        filename = ""

Region:
	              id = 2361
	        start_va = 0x7ef3d000
	          end_va = 0x7ef3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef3d000"
	        filename = ""

Region:
	              id = 2362
	        start_va = 0x6cf20000
	          end_va = 0x6cf40fff
	       monitored = 1
	     entry_point = 0x6cf298e0
	     region_type = mapped_file
	            name = "wminet_utils.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll")

Region:
	              id = 2372
	        start_va = 0x990000
	          end_va = 0x99ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000990000"
	        filename = ""

Region:
	              id = 2373
	        start_va = 0x990000
	          end_va = 0x99ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000990000"
	        filename = ""

Region:
	              id = 2376
	        start_va = 0x990000
	          end_va = 0x99ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000990000"
	        filename = ""

Region:
	              id = 2380
	        start_va = 0x5160000
	          end_va = 0x519ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005160000"
	        filename = ""

Region:
	              id = 2381
	        start_va = 0x5580000
	          end_va = 0x567ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005580000"
	        filename = ""

Region:
	              id = 2382
	        start_va = 0x4e80000
	          end_va = 0x4ebffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e80000"
	        filename = ""

Region:
	              id = 2383
	        start_va = 0x5710000
	          end_va = 0x580ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005710000"
	        filename = ""

Region:
	              id = 2384
	        start_va = 0x7ef3a000
	          end_va = 0x7ef3cfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef3a000"
	        filename = ""

Region:
	              id = 2385
	        start_va = 0x990000
	          end_va = 0x994fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000990000"
	        filename = ""

Region:
	              id = 2389
	        start_va = 0x990000
	          end_va = 0x994fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wmiutils.dll.mui"
	        filename = "\\Windows\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui" (normalized: "c:\\windows\\syswow64\\wbem\\en-us\\wmiutils.dll.mui")

Region:
	              id = 2391
	        start_va = 0x4fe0000
	          end_va = 0x501ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fe0000"
	        filename = ""

Region:
	              id = 2392
	        start_va = 0x5940000
	          end_va = 0x5a3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005940000"
	        filename = ""

Region:
	              id = 2393
	        start_va = 0x7ef37000
	          end_va = 0x7ef39fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef37000"
	        filename = ""

Region:
	              id = 2401
	        start_va = 0x1fa0000
	          end_va = 0x1fb2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2423
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2425
	        start_va = 0x5200000
	          end_va = 0x523ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005200000"
	        filename = ""

Region:
	              id = 2426
	        start_va = 0x5510000
	          end_va = 0x554ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005510000"
	        filename = ""

Region:
	              id = 2427
	        start_va = 0x7ef37000
	          end_va = 0x7ef39fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef37000"
	        filename = ""

Region:
	              id = 2429
	        start_va = 0x4fc0000
	          end_va = 0x4ffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fc0000"
	        filename = ""

Region:
	              id = 2430
	        start_va = 0x51c0000
	          end_va = 0x51fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051c0000"
	        filename = ""

Region:
	              id = 2431
	        start_va = 0x5680000
	          end_va = 0x56bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005680000"
	        filename = ""

Region:
	              id = 2432
	        start_va = 0x5970000
	          end_va = 0x5a6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005970000"
	        filename = ""

Region:
	              id = 2433
	        start_va = 0x7ef31000
	          end_va = 0x7ef33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef31000"
	        filename = ""

Region:
	              id = 2434
	        start_va = 0x7ef34000
	          end_va = 0x7ef36fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef34000"
	        filename = ""

Region:
	              id = 2791
	        start_va = 0x5180000
	          end_va = 0x51bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005180000"
	        filename = ""

Region:
	              id = 2792
	        start_va = 0x54a0000
	          end_va = 0x54dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000054a0000"
	        filename = ""

Region:
	              id = 2793
	        start_va = 0x5550000
	          end_va = 0x558ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005550000"
	        filename = ""

Region:
	              id = 2794
	        start_va = 0x5630000
	          end_va = 0x572ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005630000"
	        filename = ""

Region:
	              id = 2795
	        start_va = 0x5730000
	          end_va = 0x582ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005730000"
	        filename = ""

Region:
	              id = 2796
	        start_va = 0x7ef3d000
	          end_va = 0x7ef3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef3d000"
	        filename = ""

Region:
	              id = 2797
	        start_va = 0x1fa0000
	          end_va = 0x1fa0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 2798
	        start_va = 0x1fb0000
	          end_va = 0x1fb6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 2799
	        start_va = 0x1fa0000
	          end_va = 0x1fa0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 2800
	        start_va = 0x1fb0000
	          end_va = 0x1fb6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 2801
	        start_va = 0x1fa0000
	          end_va = 0x1fa0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 2802
	        start_va = 0x1fa0000
	          end_va = 0x1fa6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 2803
	        start_va = 0x1fa0000
	          end_va = 0x1fa0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 2804
	        start_va = 0x1fa0000
	          end_va = 0x1fa6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 2805
	        start_va = 0x1fa0000
	          end_va = 0x1fa0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll"
	        filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")

Region:
	              id = 2806
	        start_va = 0x1fa0000
	          end_va = 0x1fa6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "tzres.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")

Region:
	              id = 2807
	        start_va = 0x55e0000
	          end_va = 0x561ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000055e0000"
	        filename = ""

Region:
	              id = 2808
	        start_va = 0x5970000
	          end_va = 0x5a6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005970000"
	        filename = ""

Region:
	              id = 2809
	        start_va = 0x7ef34000
	          end_va = 0x7ef36fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef34000"
	        filename = ""

Region:
	              id = 2811
	        start_va = 0x2190000
	          end_va = 0x21cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002190000"
	        filename = ""

Region:
	              id = 2812
	        start_va = 0x4810000
	          end_va = 0x484ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004810000"
	        filename = ""

Region:
	              id = 2813
	        start_va = 0x4fc0000
	          end_va = 0x4ffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fc0000"
	        filename = ""

Region:
	              id = 2814
	        start_va = 0x55f0000
	          end_va = 0x56effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000055f0000"
	        filename = ""

Region:
	              id = 2815
	        start_va = 0x5190000
	          end_va = 0x51cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005190000"
	        filename = ""

Region:
	              id = 2816
	        start_va = 0x5980000
	          end_va = 0x5a7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005980000"
	        filename = ""

Region:
	              id = 2817
	        start_va = 0x7ef3a000
	          end_va = 0x7ef3cfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef3a000"
	        filename = ""

Region:
	              id = 2820
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2821
	        start_va = 0x1fb0000
	          end_va = 0x1fbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fb0000"
	        filename = ""

Region:
	              id = 2822
	        start_va = 0x1fc0000
	          end_va = 0x1fcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fc0000"
	        filename = ""

Region:
	              id = 2823
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2824
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2825
	        start_va = 0x2170000
	          end_va = 0x217ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002170000"
	        filename = ""

Region:
	              id = 2826
	        start_va = 0x2180000
	          end_va = 0x218ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002180000"
	        filename = ""

Region:
	              id = 2827
	        start_va = 0x2190000
	          end_va = 0x219ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002190000"
	        filename = ""

Region:
	              id = 2828
	        start_va = 0x21a0000
	          end_va = 0x21affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021a0000"
	        filename = ""

Region:
	              id = 2829
	        start_va = 0x21b0000
	          end_va = 0x21bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021b0000"
	        filename = ""

Region:
	              id = 2830
	        start_va = 0x21c0000
	          end_va = 0x21cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021c0000"
	        filename = ""

Region:
	              id = 2831
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2832
	        start_va = 0x1fb0000
	          end_va = 0x1fbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fb0000"
	        filename = ""

Region:
	              id = 2833
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2834
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2835
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2836
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2837
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2838
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2839
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2840
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2841
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2842
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2843
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2844
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2845
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2846
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2847
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2848
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2849
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2850
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2851
	        start_va = 0x1fb0000
	          end_va = 0x1fbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fb0000"
	        filename = ""

Region:
	              id = 2852
	        start_va = 0x1fc0000
	          end_va = 0x1fcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fc0000"
	        filename = ""

Region:
	              id = 2853
	        start_va = 0x1fa0000
	          end_va = 0x1faffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fa0000"
	        filename = ""

Region:
	              id = 2854
	        start_va = 0x1fb0000
	          end_va = 0x1fbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fb0000"
	        filename = ""

Region:
	              id = 2855
	        start_va = 0x70e80000
	          end_va = 0x70ea0fff
	       monitored = 0
	     entry_point = 0x70e8e356
	     region_type = mapped_file
	            name = "wshom.ocx"
	        filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx")

Region:
	              id = 2856
	        start_va = 0x703e0000
	          end_va = 0x703f1fff
	       monitored = 0
	     entry_point = 0x703e1200
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 2857
	        start_va = 0x6f6e0000
	          end_va = 0x6f709fff
	       monitored = 0
	     entry_point = 0x6f6e13f2
	     region_type = mapped_file
	            name = "scrrun.dll"
	        filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll")

Region:
	              id = 2858
	        start_va = 0x1fa0000
	          end_va = 0x1fabfff
	       monitored = 0
	     entry_point = 0x1fae356
	     region_type = mapped_file
	            name = "wshom.ocx"
	        filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx")

Region:
	              id = 2859
	        start_va = 0x1fb0000
	          end_va = 0x1fb1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "wshom.ocx.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\wshom.ocx.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshom.ocx.mui")

Region:
	              id = 2860
	        start_va = 0x1fc0000
	          end_va = 0x1fcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fc0000"
	        filename = ""

Region:
	              id = 2861
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2862
	        start_va = 0x6f470000
	          end_va = 0x6f547fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "system.security.ni.dll"
	        filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Security\\93d03eb9812405fa70e89d4efd5f7e14\\System.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.security\\93d03eb9812405fa70e89d4efd5f7e14\\system.security.ni.dll")

Region:
	              id = 2863
	        start_va = 0x768b0000
	          end_va = 0x769d0fff
	       monitored = 0
	     entry_point = 0x768b158e
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")

Region:
	              id = 2864
	        start_va = 0x766c0000
	          end_va = 0x766cbfff
	       monitored = 0
	     entry_point = 0x766c238e
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")

Region:
	              id = 2865
	        start_va = 0x1fc0000
	          end_va = 0x1fcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fc0000"
	        filename = ""

Region:
	              id = 2866
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2867
	        start_va = 0x1fc0000
	          end_va = 0x1fcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fc0000"
	        filename = ""

Region:
	              id = 2868
	        start_va = 0x1fc0000
	          end_va = 0x1fcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001fc0000"
	        filename = ""

Region:
	              id = 2869
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2870
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2871
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2872
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2873
	        start_va = 0x2170000
	          end_va = 0x217ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002170000"
	        filename = ""

Region:
	              id = 2874
	        start_va = 0x2180000
	          end_va = 0x218ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002180000"
	        filename = ""

Region:
	              id = 2875
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2876
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2877
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2878
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2879
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2880
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2881
	        start_va = 0x2170000
	          end_va = 0x217ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002170000"
	        filename = ""

Region:
	              id = 2882
	        start_va = 0x2190000
	          end_va = 0x219ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002190000"
	        filename = ""

Region:
	              id = 2883
	        start_va = 0x21a0000
	          end_va = 0x21affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021a0000"
	        filename = ""

Region:
	              id = 2884
	        start_va = 0x21b0000
	          end_va = 0x21bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021b0000"
	        filename = ""

Region:
	              id = 2885
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2886
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2887
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2888
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2889
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2890
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2891
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2892
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2893
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2894
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2895
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2896
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2897
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2898
	        start_va = 0x2170000
	          end_va = 0x217ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002170000"
	        filename = ""

Region:
	              id = 2899
	        start_va = 0x2190000
	          end_va = 0x219ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002190000"
	        filename = ""

Region:
	              id = 2900
	        start_va = 0x21a0000
	          end_va = 0x21affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021a0000"
	        filename = ""

Region:
	              id = 2901
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2902
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2903
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2904
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2905
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2906
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2907
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2908
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2909
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2910
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2911
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2912
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2913
	        start_va = 0x2010000
	          end_va = 0x201ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 2914
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2915
	        start_va = 0x2170000
	          end_va = 0x217ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002170000"
	        filename = ""

Region:
	              id = 2916
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2917
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2918
	        start_va = 0x4e80000
	          end_va = 0x4ee1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "mscorrc.dll"
	        filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll")

Region:
	              id = 2919
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2920
	        start_va = 0x2170000
	          end_va = 0x217ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002170000"
	        filename = ""

Region:
	              id = 2921
	        start_va = 0x2190000
	          end_va = 0x219ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002190000"
	        filename = ""

Region:
	              id = 2922
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2923
	        start_va = 0x751e0000
	          end_va = 0x751ebfff
	       monitored = 0
	     entry_point = 0x751e505c
	     region_type = mapped_file
	            name = "vaultcli.dll"
	        filename = "\\Windows\\SysWOW64\\vaultcli.dll" (normalized: "c:\\windows\\syswow64\\vaultcli.dll")

Region:
	              id = 2924
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2925
	        start_va = 0x4380000
	          end_va = 0x43bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004380000"
	        filename = ""

Region:
	              id = 2926
	        start_va = 0x55a0000
	          end_va = 0x569ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000055a0000"
	        filename = ""

Region:
	              id = 2927
	        start_va = 0x7efaa000
	          end_va = 0x7efacfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007efaa000"
	        filename = ""

Region:
	              id = 2928
	        start_va = 0x4f60000
	          end_va = 0x4f9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f60000"
	        filename = ""

Region:
	              id = 2929
	        start_va = 0x58f0000
	          end_va = 0x59effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000058f0000"
	        filename = ""

Region:
	              id = 2930
	        start_va = 0x7ef3d000
	          end_va = 0x7ef3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef3d000"
	        filename = ""

Region:
	              id = 2931
	        start_va = 0x4fd0000
	          end_va = 0x500ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004fd0000"
	        filename = ""

Region:
	              id = 2932
	        start_va = 0x5aa0000
	          end_va = 0x5b9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005aa0000"
	        filename = ""

Region:
	              id = 2933
	        start_va = 0x51c0000
	          end_va = 0x51fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000051c0000"
	        filename = ""

Region:
	              id = 2934
	        start_va = 0x5550000
	          end_va = 0x564ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005550000"
	        filename = ""

Region:
	              id = 2935
	        start_va = 0x7ef3a000
	          end_va = 0x7ef3cfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef3a000"
	        filename = ""

Region:
	              id = 2936
	        start_va = 0x2020000
	          end_va = 0x2022fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002020000"
	        filename = ""

Region:
	              id = 2937
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2938
	        start_va = 0x5180000
	          end_va = 0x51bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005180000"
	        filename = ""

Region:
	              id = 2939
	        start_va = 0x5ca0000
	          end_va = 0x5d9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ca0000"
	        filename = ""

Region:
	              id = 2940
	        start_va = 0x7ef34000
	          end_va = 0x7ef36fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef34000"
	        filename = ""

Region:
	              id = 2950
	        start_va = 0x2020000
	          end_va = 0x2022fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002020000"
	        filename = ""

Region:
	              id = 2951
	        start_va = 0x2020000
	          end_va = 0x202ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002020000"
	        filename = ""

Region:
	              id = 2952
	        start_va = 0x2170000
	          end_va = 0x217ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002170000"
	        filename = ""

Region:
	              id = 2953
	        start_va = 0x74420000
	          end_va = 0x7443bfff
	       monitored = 0
	     entry_point = 0x7442a431
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")

Region:
	              id = 2954
	        start_va = 0x74410000
	          end_va = 0x74416fff
	       monitored = 0
	     entry_point = 0x7441128d
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")

Region:
	              id = 2955
	        start_va = 0x74440000
	          end_va = 0x74483fff
	       monitored = 0
	     entry_point = 0x744563f9
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")

Region:
	              id = 2956
	        start_va = 0x5ba0000
	          end_va = 0x5ceffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ba0000"
	        filename = ""

Region:
	              id = 2957
	        start_va = 0x703d0000
	          end_va = 0x703dcfff
	       monitored = 0
	     entry_point = 0x703d2012
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll")

Region:
	              id = 2958
	        start_va = 0x6f6c0000
	          end_va = 0x6f6d1fff
	       monitored = 0
	     entry_point = 0x6f6c3271
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll")

Region:
	              id = 2959
	        start_va = 0x4f00000
	          end_va = 0x4f3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f00000"
	        filename = ""

Region:
	              id = 2960
	        start_va = 0x5d30000
	          end_va = 0x5e2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d30000"
	        filename = ""

Region:
	              id = 2961
	        start_va = 0x7ef34000
	          end_va = 0x7ef36fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef34000"
	        filename = ""

Region:
	              id = 2962
	        start_va = 0x743c0000
	          end_va = 0x743fbfff
	       monitored = 0
	     entry_point = 0x743c145d
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 2963
	        start_va = 0x743b0000
	          end_va = 0x743b4fff
	       monitored = 0
	     entry_point = 0x743b15df
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll")

Region:
	              id = 2964
	        start_va = 0x743a0000
	          end_va = 0x743a5fff
	       monitored = 0
	     entry_point = 0x743a1673
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll")

Region:
	              id = 2965
	        start_va = 0x74310000
	          end_va = 0x74315fff
	       monitored = 0
	     entry_point = 0x743114b2
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")

Region:
	              id = 2966
	        start_va = 0x742a0000
	          end_va = 0x742d7fff
	       monitored = 0
	     entry_point = 0x742a990e
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")

Region:
	              id = 2967
	        start_va = 0x5ba0000
	          end_va = 0x5caffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ba0000"
	        filename = ""

Region:
	              id = 2968
	        start_va = 0x5cb0000
	          end_va = 0x5ceffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005cb0000"
	        filename = ""

Region:
	              id = 2969
	        start_va = 0x5490000
	          end_va = 0x54cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005490000"
	        filename = ""

Region:
	              id = 2970
	        start_va = 0x5690000
	          end_va = 0x56cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005690000"
	        filename = ""

Region:
	              id = 2971
	        start_va = 0x5a00000
	          end_va = 0x5a3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005a00000"
	        filename = ""

Region:
	              id = 2972
	        start_va = 0x5f90000
	          end_va = 0x608ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005f90000"
	        filename = ""

Region:
	              id = 2973
	        start_va = 0x7ef2e000
	          end_va = 0x7ef30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef2e000"
	        filename = ""

Region:
	              id = 2974
	        start_va = 0x7ef31000
	          end_va = 0x7ef33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ef31000"
	        filename = ""

Region:
	              id = 2975
	        start_va = 0x5130000
	          end_va = 0x51b1fff
	       monitored = 0
	     entry_point = 0x51319a9
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 2976
	        start_va = 0x5130000
	          end_va = 0x51b1fff
	       monitored = 0
	     entry_point = 0x51319a9
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 2977
	        start_va = 0x6dc40000
	          end_va = 0x6dcc3fff
	       monitored = 0
	     entry_point = 0x6dc419a9
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")

Region:
	              id = 2978
	        start_va = 0x5130000
	          end_va = 0x51bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005130000"
	        filename = ""


Thread:
	id = 73
	os_tid = 0xab8

	[0146.787] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
	[0148.106] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", nBufferLength=0x105, lpBuffer=0x53d208, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", lpFilePart=0x0) returned 0x66
	[0148.125] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x53cf00 | out: phkResult=0x53cf00*=0x0) returned 0x2
	[0148.126] RegCloseKey (hKey=0x80000002) returned 0x0
	[0148.316] GetCurrentProcess () returned 0xffffffff
	[0148.317] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53d540 | out: TokenHandle=0x53d540*=0x40) returned 1
	[0148.324] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x53cff8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
	[0148.391] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x53d538 | out: lpFileInformation=0x53d538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1
	[0148.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x53cfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0148.398] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x53d540 | out: lpFileInformation=0x53d540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1
	[0148.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x53cf60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0148.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53d478) returned 1
	[0148.422] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1f0
	[0148.423] GetFileType (hFile=0x1f0) returned 0x1
	[0148.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d474) returned 1
	[0148.423] GetFileType (hFile=0x1f0) returned 0x1
	[0148.463] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x53c7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43
	[0148.463] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x53c814, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43
	[0148.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53ca54) returned 1
	[0148.464] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x53cd18 | out: lpFileInformation=0x53cd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1
	[0148.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53ca50) returned 1
	[0148.606] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x53cbe4 | out: pfEnabled=0x53cbe4) returned 0x0
	[0148.713] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x53d534 | out: lpFileSizeHigh=0x53d534*=0x0) returned 0x8c8e
	[0148.713] ReadFile (in: hFile=0x1f0, lpBuffer=0x2262f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53d4f0, lpOverlapped=0x0 | out: lpBuffer=0x2262f04*, lpNumberOfBytesRead=0x53d4f0*=0x1000, lpOverlapped=0x0) returned 1
	[0148.728] ReadFile (in: hFile=0x1f0, lpBuffer=0x2262f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53d3a0, lpOverlapped=0x0 | out: lpBuffer=0x2262f04*, lpNumberOfBytesRead=0x53d3a0*=0x1000, lpOverlapped=0x0) returned 1
	[0148.730] ReadFile (in: hFile=0x1f0, lpBuffer=0x2262f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53d254, lpOverlapped=0x0 | out: lpBuffer=0x2262f04*, lpNumberOfBytesRead=0x53d254*=0x1000, lpOverlapped=0x0) returned 1
	[0148.778] ReadFile (in: hFile=0x1f0, lpBuffer=0x2262f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53d254, lpOverlapped=0x0 | out: lpBuffer=0x2262f04*, lpNumberOfBytesRead=0x53d254*=0x1000, lpOverlapped=0x0) returned 1
	[0148.778] ReadFile (in: hFile=0x1f0, lpBuffer=0x2262f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53d254, lpOverlapped=0x0 | out: lpBuffer=0x2262f04*, lpNumberOfBytesRead=0x53d254*=0x1000, lpOverlapped=0x0) returned 1
	[0148.779] ReadFile (in: hFile=0x1f0, lpBuffer=0x2262f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53d18c, lpOverlapped=0x0 | out: lpBuffer=0x2262f04*, lpNumberOfBytesRead=0x53d18c*=0x1000, lpOverlapped=0x0) returned 1
	[0148.787] ReadFile (in: hFile=0x1f0, lpBuffer=0x2262f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53d2f8, lpOverlapped=0x0 | out: lpBuffer=0x2262f04*, lpNumberOfBytesRead=0x53d2f8*=0x1000, lpOverlapped=0x0) returned 1
	[0148.790] ReadFile (in: hFile=0x1f0, lpBuffer=0x2262f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53d1ec, lpOverlapped=0x0 | out: lpBuffer=0x2262f04*, lpNumberOfBytesRead=0x53d1ec*=0x1000, lpOverlapped=0x0) returned 1
	[0148.790] ReadFile (in: hFile=0x1f0, lpBuffer=0x2262f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53d1ec, lpOverlapped=0x0 | out: lpBuffer=0x2262f04*, lpNumberOfBytesRead=0x53d1ec*=0xc8e, lpOverlapped=0x0) returned 1
	[0148.790] ReadFile (in: hFile=0x1f0, lpBuffer=0x2262f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53d2b0, lpOverlapped=0x0 | out: lpBuffer=0x2262f04*, lpNumberOfBytesRead=0x53d2b0*=0x0, lpOverlapped=0x0) returned 1
	[0148.791] CloseHandle (hObject=0x1f0) returned 1
	[0148.791] CloseHandle (hObject=0x40) returned 1
	[0148.793] GetCurrentProcess () returned 0xffffffff
	[0148.793] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53d68c | out: TokenHandle=0x53d68c*=0x40) returned 1
	[0148.794] CloseHandle (hObject=0x40) returned 1
	[0148.795] GetCurrentProcess () returned 0xffffffff
	[0148.795] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53d68c | out: TokenHandle=0x53d68c*=0x40) returned 1
	[0148.796] CloseHandle (hObject=0x40) returned 1
	[0148.807] GetCurrentProcess () returned 0xffffffff
	[0148.807] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53d540 | out: TokenHandle=0x53d540*=0x40) returned 1
	[0148.808] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x53d538 | out: lpFileInformation=0x53d538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0148.808] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", nBufferLength=0x105, lpBuffer=0x53cfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", lpFilePart=0x0) returned 0x66
	[0148.810] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x53d540 | out: lpFileInformation=0x53d540*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0148.810] CloseHandle (hObject=0x40) returned 1
	[0148.810] GetCurrentProcess () returned 0xffffffff
	[0148.811] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53d68c | out: TokenHandle=0x53d68c*=0x40) returned 1
	[0148.811] CloseHandle (hObject=0x40) returned 1
	[0148.813] GetCurrentProcess () returned 0xffffffff
	[0148.814] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53d68c | out: TokenHandle=0x53d68c*=0x40) returned 1
	[0148.815] CloseHandle (hObject=0x40) returned 1
	[0148.883] GetCurrentProcess () returned 0xffffffff
	[0148.884] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53d4a4 | out: TokenHandle=0x53d4a4*=0x40) returned 1
	[0148.896] CloseHandle (hObject=0x40) returned 1
	[0148.897] GetCurrentProcess () returned 0xffffffff
	[0148.897] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53d4bc | out: TokenHandle=0x53d4bc*=0x40) returned 1
	[0148.904] CloseHandle (hObject=0x40) returned 1
	[0149.004] GetModuleHandleW (lpModuleName="user32.dll") returned 0x766d0000
	[0149.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x53d708, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWïmb\x9d\x1a Dþ<r\x14ÚS", lpUsedDefaultChar=0x0) returned 14
	[0149.005] GetProcAddress (hModule=0x766d0000, lpProcName="DefWindowProcW") returned 0x778f25dd
	[0149.006] GetStockObject (i=5) returned 0x1900015
	[0149.012] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
	[0149.017] CoTaskMemAlloc (cb=0x5c) returned 0xa07a88
	[0149.017] RegisterClassW (lpWndClass=0x53d6f8) returned 0xc1bd
	[0149.019] CoTaskMemFree (pv=0xa07a88) 
	[0149.019] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
	[0149.022] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.0.app.0.34f5582_r14_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0xc009e
	[0149.024] SetWindowLongW (hWnd=0xc009e, nIndex=-4, dwNewLong=2005870045) returned 81004758
	[0149.026] GetWindowLongW (hWnd=0xc009e, nIndex=-4) returned 2005870045
	[0149.031] GetCurrentProcess () returned 0xffffffff
	[0149.031] GetCurrentThread () returned 0xfffffffe
	[0149.031] GetCurrentProcess () returned 0xffffffff
	[0149.031] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x53d088, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x53d088*=0x40) returned 1
	[0149.033] GetCurrentThreadId () returned 0xab8
	[0149.039] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x53d00c | out: phkResult=0x53d00c*=0x1f0) returned 0x0
	[0149.040] RegQueryValueExW (in: hKey=0x1f0, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x53d02c, lpData=0x0, lpcbData=0x53d028*=0x0 | out: lpType=0x53d02c*=0x0, lpData=0x0, lpcbData=0x53d028*=0x0) returned 0x2
	[0149.040] RegQueryValueExW (in: hKey=0x1f0, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x53d02c, lpData=0x0, lpcbData=0x53d028*=0x0 | out: lpType=0x53d02c*=0x0, lpData=0x0, lpcbData=0x53d028*=0x0) returned 0x2
	[0149.040] RegCloseKey (hKey=0x1f0) returned 0x0
	[0149.049] SetWindowLongW (hWnd=0xc009e, nIndex=-4, dwNewLong=81004798) returned 2005870045
	[0149.049] GetWindowLongW (hWnd=0xc009e, nIndex=-4) returned 81004798
	[0149.049] GetWindowLongW (hWnd=0xc009e, nIndex=-16) returned 79691776
	[0149.113] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0xc009e, Msg=0x24, wParam=0x0, lParam=0x53d2e4) returned 0x0
	[0149.114] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc108
	[0149.114] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0xc009e, Msg=0x81, wParam=0x0, lParam=0x53d2d8) returned 0x1
	[0149.117] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0xc009e, Msg=0x83, wParam=0x0, lParam=0x53d2c4) returned 0x0
	[0149.345] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0xc009e, Msg=0x1, wParam=0x0, lParam=0x53d2d8) returned 0x0
	[0149.746] GetCurrentProcessId () returned 0xabc
	[0149.815] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x53e8b4 | out: lpLuid=0x53e8b4*(LowPart=0x14, HighPart=0)) returned 1
	[0149.818] GetCurrentProcess () returned 0xffffffff
	[0149.819] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x53e8b0 | out: TokenHandle=0x53e8b0*=0x238) returned 1
	[0149.819] AdjustTokenPrivileges (in: TokenHandle=0x238, DisableAllPrivileges=0, NewState=0x227e078*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0149.820] CloseHandle (hObject=0x238) returned 1
	[0149.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3239540, Length=0x20000, ResultLength=0x53ef94 | out: SystemInformation=0x3239540, ResultLength=0x53ef94*=0xcf78) returned 0x0
	[0149.862] GetCurrentProcessId () returned 0xabc
	[0149.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3239540, Length=0x20000, ResultLength=0x53ef84 | out: SystemInformation=0x3239540, ResultLength=0x53ef84*=0xcf78) returned 0x0
	[0157.218] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x238
	[0157.218] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x23c
	[0157.238] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e14c | out: phkResult=0x53e14c*=0x240) returned 0x0
	[0157.238] RegQueryValueExW (in: hKey=0x240, lpValueName="InstallationType", lpReserved=0x0, lpType=0x53e16c, lpData=0x0, lpcbData=0x53e168*=0x0 | out: lpType=0x53e16c*=0x1, lpData=0x0, lpcbData=0x53e168*=0xe) returned 0x0
	[0157.240] RegQueryValueExW (in: hKey=0x240, lpValueName="InstallationType", lpReserved=0x0, lpType=0x53e16c, lpData=0x22a2e64, lpcbData=0x53e168*=0xe | out: lpType=0x53e16c*=0x1, lpData="Client", lpcbData=0x53e168*=0xe) returned 0x0
	[0157.240] RegCloseKey (hKey=0x240) returned 0x0
	[0157.307] GetCurrentProcess () returned 0xffffffff
	[0157.307] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53dda0 | out: TokenHandle=0x53dda0*=0x240) returned 1
	[0157.432] CloseHandle (hObject=0x240) returned 1
	[0157.433] GetCurrentProcess () returned 0xffffffff
	[0157.434] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53ddb8 | out: TokenHandle=0x53ddb8*=0x240) returned 1
	[0157.435] CloseHandle (hObject=0x240) returned 1
	[0157.478] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef14 | out: phkResult=0x53ef14*=0x240) returned 0x0
	[0157.479] RegQueryValueExW (in: hKey=0x240, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x53ef30, lpData=0x0, lpcbData=0x53ef2c*=0x0 | out: lpType=0x53ef30*=0x0, lpData=0x0, lpcbData=0x53ef2c*=0x0) returned 0x2
	[0157.479] RegCloseKey (hKey=0x240) returned 0x0
	[0157.486] GetCurrentProcessId () returned 0xabc
	[0157.491] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xabc) returned 0x240
	[0157.528] EnumProcessModules (in: hProcess=0x240, lphModule=0x22a6d54, cb=0x100, lpcbNeeded=0x53ef20 | out: lphModule=0x22a6d54, lpcbNeeded=0x53ef20) returned 1
	[0157.532] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x22a6e94, cb=0xc | out: lpmodinfo=0x22a6e94*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x4375ee)) returned 1
	[0157.535] CoTaskMemAlloc (cb=0x804) returned 0xa29850
	[0157.535] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0xa29850, nSize=0x800 | out: lpBaseName="85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe") returned 0x44
	[0157.537] CoTaskMemFree (pv=0xa29850) 
	[0157.537] CoTaskMemAlloc (cb=0x804) returned 0xa29850
	[0157.537] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0xa29850, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")) returned 0x5f
	[0157.538] CoTaskMemFree (pv=0xa29850) 
	[0157.538] CloseHandle (hObject=0x240) returned 1
	[0157.539] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", nBufferLength=0x105, lpBuffer=0x53ea48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpFilePart=0x0) returned 0x5f
	[0157.540] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x0) returned 0x2
	[0157.540] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x240) returned 0x0
	[0157.541] RegQueryValueExW (in: hKey=0x240, lpValueName="UseHttpPipeliningAndBufferPooling", lpReserved=0x0, lpType=0x53ef34, lpData=0x0, lpcbData=0x53ef30*=0x0 | out: lpType=0x53ef34*=0x0, lpData=0x0, lpcbData=0x53ef30*=0x0) returned 0x2
	[0157.541] RegCloseKey (hKey=0x240) returned 0x0
	[0157.542] GetCurrentProcessId () returned 0xabc
	[0157.542] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xabc) returned 0x240
	[0157.542] EnumProcessModules (in: hProcess=0x240, lphModule=0x22a9a0c, cb=0x100, lpcbNeeded=0x53ef20 | out: lphModule=0x22a9a0c, lpcbNeeded=0x53ef20) returned 1
	[0157.544] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x22a9b4c, cb=0xc | out: lpmodinfo=0x22a9b4c*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x4375ee)) returned 1
	[0157.545] CoTaskMemAlloc (cb=0x804) returned 0xa29850
	[0157.545] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0xa29850, nSize=0x800 | out: lpBaseName="85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe") returned 0x44
	[0157.545] CoTaskMemFree (pv=0xa29850) 
	[0157.545] CoTaskMemAlloc (cb=0x804) returned 0xa29850
	[0157.545] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0xa29850, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")) returned 0x5f
	[0157.546] CoTaskMemFree (pv=0xa29850) 
	[0157.546] CloseHandle (hObject=0x240) returned 1
	[0157.546] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", nBufferLength=0x105, lpBuffer=0x53ea48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpFilePart=0x0) returned 0x5f
	[0157.547] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseSafeSynchronousClose", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x0) returned 0x2
	[0157.548] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x240) returned 0x0
	[0157.548] RegQueryValueExW (in: hKey=0x240, lpValueName="UseSafeSynchronousClose", lpReserved=0x0, lpType=0x53ef34, lpData=0x0, lpcbData=0x53ef30*=0x0 | out: lpType=0x53ef34*=0x0, lpData=0x0, lpcbData=0x53ef30*=0x0) returned 0x2
	[0157.549] RegCloseKey (hKey=0x240) returned 0x0
	[0157.550] GetCurrentProcessId () returned 0xabc
	[0157.550] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xabc) returned 0x240
	[0157.550] EnumProcessModules (in: hProcess=0x240, lphModule=0x22ac6f0, cb=0x100, lpcbNeeded=0x53ef20 | out: lphModule=0x22ac6f0, lpcbNeeded=0x53ef20) returned 1
	[0157.552] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x22ac830, cb=0xc | out: lpmodinfo=0x22ac830*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x4375ee)) returned 1
	[0157.552] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.552] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0xa29b90, nSize=0x800 | out: lpBaseName="85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe") returned 0x44
	[0157.552] CoTaskMemFree (pv=0xa29b90) 
	[0157.553] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.553] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0xa29b90, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")) returned 0x5f
	[0157.554] CoTaskMemFree (pv=0xa29b90) 
	[0157.554] CloseHandle (hObject=0x240) returned 1
	[0157.554] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", nBufferLength=0x105, lpBuffer=0x53ea48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpFilePart=0x0) returned 0x5f
	[0157.555] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x0) returned 0x2
	[0157.556] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x240) returned 0x0
	[0157.556] RegQueryValueExW (in: hKey=0x240, lpValueName="UseStrictRfcInterimResponseHandling", lpReserved=0x0, lpType=0x53ef34, lpData=0x0, lpcbData=0x53ef30*=0x0 | out: lpType=0x53ef34*=0x0, lpData=0x0, lpcbData=0x53ef30*=0x0) returned 0x2
	[0157.556] RegCloseKey (hKey=0x240) returned 0x0
	[0157.557] GetCurrentProcessId () returned 0xabc
	[0157.557] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xabc) returned 0x240
	[0157.558] EnumProcessModules (in: hProcess=0x240, lphModule=0x22af464, cb=0x100, lpcbNeeded=0x53ef20 | out: lphModule=0x22af464, lpcbNeeded=0x53ef20) returned 1
	[0157.559] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x22af5a4, cb=0xc | out: lpmodinfo=0x22af5a4*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x4375ee)) returned 1
	[0157.559] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.559] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0xa29b90, nSize=0x800 | out: lpBaseName="85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe") returned 0x44
	[0157.571] CoTaskMemFree (pv=0xa29b90) 
	[0157.571] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.571] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0xa29b90, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")) returned 0x5f
	[0157.572] CoTaskMemFree (pv=0xa29b90) 
	[0157.572] CloseHandle (hObject=0x240) returned 1
	[0157.572] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", nBufferLength=0x105, lpBuffer=0x53ea48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpFilePart=0x0) returned 0x5f
	[0157.573] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowDangerousUnicodeDecompositions", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x0) returned 0x2
	[0157.573] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x240) returned 0x0
	[0157.573] RegQueryValueExW (in: hKey=0x240, lpValueName="AllowDangerousUnicodeDecompositions", lpReserved=0x0, lpType=0x53ef34, lpData=0x0, lpcbData=0x53ef30*=0x0 | out: lpType=0x53ef34*=0x0, lpData=0x0, lpcbData=0x53ef30*=0x0) returned 0x2
	[0157.573] RegCloseKey (hKey=0x240) returned 0x0
	[0157.574] GetCurrentProcessId () returned 0xabc
	[0157.574] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xabc) returned 0x240
	[0157.578] EnumProcessModules (in: hProcess=0x240, lphModule=0x22b1fa8, cb=0x100, lpcbNeeded=0x53ef20 | out: lphModule=0x22b1fa8, lpcbNeeded=0x53ef20) returned 1
	[0157.579] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x22b20e8, cb=0xc | out: lpmodinfo=0x22b20e8*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x4375ee)) returned 1
	[0157.579] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.580] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0xa29b90, nSize=0x800 | out: lpBaseName="85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe") returned 0x44
	[0157.580] CoTaskMemFree (pv=0xa29b90) 
	[0157.580] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.580] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0xa29b90, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")) returned 0x5f
	[0157.581] CoTaskMemFree (pv=0xa29b90) 
	[0157.581] CloseHandle (hObject=0x240) returned 1
	[0157.581] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", nBufferLength=0x105, lpBuffer=0x53ea48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpFilePart=0x0) returned 0x5f
	[0157.582] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.UseStrictIPv6AddressParsing", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x0) returned 0x2
	[0157.582] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x240) returned 0x0
	[0157.582] RegQueryValueExW (in: hKey=0x240, lpValueName="UseStrictIPv6AddressParsing", lpReserved=0x0, lpType=0x53ef34, lpData=0x0, lpcbData=0x53ef30*=0x0 | out: lpType=0x53ef34*=0x0, lpData=0x0, lpcbData=0x53ef30*=0x0) returned 0x2
	[0157.583] RegCloseKey (hKey=0x240) returned 0x0
	[0157.583] GetCurrentProcessId () returned 0xabc
	[0157.584] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xabc) returned 0x240
	[0157.584] EnumProcessModules (in: hProcess=0x240, lphModule=0x22b4ac4, cb=0x100, lpcbNeeded=0x53ef20 | out: lphModule=0x22b4ac4, lpcbNeeded=0x53ef20) returned 1
	[0157.585] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x22b4c04, cb=0xc | out: lpmodinfo=0x22b4c04*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x4375ee)) returned 1
	[0157.585] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.585] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0xa29b90, nSize=0x800 | out: lpBaseName="85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe") returned 0x44
	[0157.585] CoTaskMemFree (pv=0xa29b90) 
	[0157.585] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.585] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0xa29b90, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")) returned 0x5f
	[0157.586] CoTaskMemFree (pv=0xa29b90) 
	[0157.586] CloseHandle (hObject=0x240) returned 1
	[0157.586] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", nBufferLength=0x105, lpBuffer=0x53ea48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpFilePart=0x0) returned 0x5f
	[0157.586] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowAllUriEncodingExpansion", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x0) returned 0x2
	[0157.587] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x240) returned 0x0
	[0157.587] RegQueryValueExW (in: hKey=0x240, lpValueName="AllowAllUriEncodingExpansion", lpReserved=0x0, lpType=0x53ef34, lpData=0x0, lpcbData=0x53ef30*=0x0 | out: lpType=0x53ef34*=0x0, lpData=0x0, lpcbData=0x53ef30*=0x0) returned 0x2
	[0157.587] RegCloseKey (hKey=0x240) returned 0x0
	[0157.607] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x240) returned 0x0
	[0157.607] RegQueryValueExW (in: hKey=0x240, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x53ef34, lpData=0x0, lpcbData=0x53ef30*=0x0 | out: lpType=0x53ef34*=0x0, lpData=0x0, lpcbData=0x53ef30*=0x0) returned 0x2
	[0157.607] RegCloseKey (hKey=0x240) returned 0x0
	[0157.608] GetCurrentProcessId () returned 0xabc
	[0157.608] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xabc) returned 0x240
	[0157.609] EnumProcessModules (in: hProcess=0x240, lphModule=0x22b84f8, cb=0x100, lpcbNeeded=0x53ef1c | out: lphModule=0x22b84f8, lpcbNeeded=0x53ef1c) returned 1
	[0157.610] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x22b8638, cb=0xc | out: lpmodinfo=0x22b8638*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x4375ee)) returned 1
	[0157.610] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.610] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0xa29b90, nSize=0x800 | out: lpBaseName="85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe") returned 0x44
	[0157.611] CoTaskMemFree (pv=0xa29b90) 
	[0157.611] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.611] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0xa29b90, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")) returned 0x5f
	[0157.611] CoTaskMemFree (pv=0xa29b90) 
	[0157.611] CloseHandle (hObject=0x240) returned 1
	[0157.612] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", nBufferLength=0x105, lpBuffer=0x53ea44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpFilePart=0x0) returned 0x5f
	[0157.612] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef14 | out: phkResult=0x53ef14*=0x0) returned 0x2
	[0157.613] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef14 | out: phkResult=0x53ef14*=0x240) returned 0x0
	[0157.613] RegQueryValueExW (in: hKey=0x240, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x53ef30, lpData=0x0, lpcbData=0x53ef2c*=0x0 | out: lpType=0x53ef30*=0x0, lpData=0x0, lpcbData=0x53ef2c*=0x0) returned 0x2
	[0157.613] RegCloseKey (hKey=0x240) returned 0x0
	[0157.614] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef18 | out: phkResult=0x53ef18*=0x240) returned 0x0
	[0157.614] RegQueryValueExW (in: hKey=0x240, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0x53ef34, lpData=0x0, lpcbData=0x53ef30*=0x0 | out: lpType=0x53ef34*=0x0, lpData=0x0, lpcbData=0x53ef30*=0x0) returned 0x2
	[0157.615] RegCloseKey (hKey=0x240) returned 0x0
	[0157.616] GetCurrentProcessId () returned 0xabc
	[0157.616] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xabc) returned 0x240
	[0157.616] EnumProcessModules (in: hProcess=0x240, lphModule=0x22bb3f8, cb=0x100, lpcbNeeded=0x53ef1c | out: lphModule=0x22bb3f8, lpcbNeeded=0x53ef1c) returned 1
	[0157.618] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x22bb538, cb=0xc | out: lpmodinfo=0x22bb538*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x4375ee)) returned 1
	[0157.618] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.618] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0xa29b90, nSize=0x800 | out: lpBaseName="85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe") returned 0x44
	[0157.619] CoTaskMemFree (pv=0xa29b90) 
	[0157.619] CoTaskMemAlloc (cb=0x804) returned 0xa29b90
	[0157.619] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0xa29b90, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe")) returned 0x5f
	[0157.619] CoTaskMemFree (pv=0xa29b90) 
	[0157.619] CloseHandle (hObject=0x240) returned 1
	[0157.620] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", nBufferLength=0x105, lpBuffer=0x53ea44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpFilePart=0x0) returned 0x5f
	[0157.621] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef14 | out: phkResult=0x53ef14*=0x0) returned 0x2
	[0157.621] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ef14 | out: phkResult=0x53ef14*=0x240) returned 0x0
	[0157.622] RegQueryValueExW (in: hKey=0x240, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0x53ef30, lpData=0x0, lpcbData=0x53ef2c*=0x0 | out: lpType=0x53ef30*=0x0, lpData=0x0, lpcbData=0x53ef2c*=0x0) returned 0x2
	[0157.622] RegCloseKey (hKey=0x240) returned 0x0
	[0157.756] CreateBindCtx (in: reserved=0x0, ppbc=0x53ef74 | out: ppbc=0x53ef74*=0x9e40d0) returned 0x0
	[0157.757] IUnknown:QueryInterface (in: This=0x9e40d0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ea30 | out: ppvObject=0x53ea30*=0x9e40d0) returned 0x0
	[0157.759] IUnknown:QueryInterface (in: This=0x9e40d0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e9e4 | out: ppvObject=0x53e9e4*=0x0) returned 0x80004002
	[0157.759] IUnknown:QueryInterface (in: This=0x9e40d0, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e80c | out: ppvObject=0x53e80c*=0x0) returned 0x80004002
	[0157.760] IUnknown:AddRef (This=0x9e40d0) returned 0x3
	[0157.760] IUnknown:QueryInterface (in: This=0x9e40d0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53e340 | out: ppvObject=0x53e340*=0x0) returned 0x80004002
	[0157.760] IUnknown:QueryInterface (in: This=0x9e40d0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53e2f0 | out: ppvObject=0x53e2f0*=0x0) returned 0x80004002
	[0157.760] IUnknown:QueryInterface (in: This=0x9e40d0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e2fc | out: ppvObject=0x53e2fc*=0x0) returned 0x80004002
	[0157.760] CoGetContextToken (in: pToken=0x53e35c | out: pToken=0x53e35c) returned 0x0
	[0157.761] CObjectContext::QueryInterface () returned 0x0
	[0157.761] CObjectContext::GetCurrentApartmentType () returned 0x0
	[0157.761] Release () returned 0x0
	[0157.764] CoGetObjectContext (in: riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xa2182c | out: ppv=0xa2182c*=0x9f1d30) returned 0x0
	[0157.867] CoGetContextToken (in: pToken=0x53e76c | out: pToken=0x53e76c) returned 0x0
	[0157.867] IUnknown:QueryInterface (in: This=0x9e40d0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e7f0 | out: ppvObject=0x53e7f0*=0x0) returned 0x80004002
	[0157.868] IUnknown:Release (This=0x9e40d0) returned 0x2
	[0157.868] CoGetContextToken (in: pToken=0x53ed3c | out: pToken=0x53ed3c) returned 0x0
	[0157.868] CoGetContextToken (in: pToken=0x53ec9c | out: pToken=0x53ec9c) returned 0x0
	[0157.868] IUnknown:QueryInterface (in: This=0x9e40d0, riid=0x53ed6c*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ed68 | out: ppvObject=0x53ed68*=0x9e40d0) returned 0x0
	[0157.868] IUnknown:AddRef (This=0x9e40d0) returned 0x4
	[0157.868] IUnknown:Release (This=0x9e40d0) returned 0x3
	[0157.869] IUnknown:Release (This=0x9e40d0) returned 0x2
	[0157.870] CoGetContextToken (in: pToken=0x53edc4 | out: pToken=0x53edc4) returned 0x0
	[0157.870] IUnknown:AddRef (This=0x9e40d0) returned 0x3
	[0157.870] MkParseDisplayName (in: pbc=0x9e40d0, szUserName="WinMgmts:", pchEaten=0x53efa8, ppmk=0x53ef60 | out: pchEaten=0x53efa8, ppmk=0x53ef60*=0xa33ab0) returned 0x0
	[0158.459] malloc (_Size=0x80) returned 0x112e70
	[0158.465] DllGetClassObject (in: rclsid=0xa3708c*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x53eba0*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53e258 | out: ppv=0x53e258*=0x0) returned 0x80004002
	[0158.465] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280810
	[0158.465] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.466] DllGetClassObject (in: rclsid=0xa3708c*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x7641ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53ed54 | out: ppv=0x53ed54*=0x4280810) returned 0x0
	[0158.466] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280810
	[0158.466] WinMGMTS:IClassFactory:CreateInstance (in: This=0x4280810, pUnkOuter=0x0, riid=0x7641f084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ed00 | out: ppvObject=0x53ed00*=0x4280850) returned 0x0
	[0158.466] GetVersionExW (in: lpVersionInformation=0x53eb4c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7f, dwMinorVersion=0x36b7, dwBuildNumber=0x3, dwPlatformId=0x53ebb0, szCSDVersion="堡眬\x08쀕") | out: lpVersionInformation=0x53eb4c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0158.466] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x53eb40 | out: phkResult=0x53eb40*=0x284) returned 0x0
	[0158.467] RegQueryValueExW (in: hKey=0x284, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x53eb48, lpcbData=0x53eb44*=0x4 | out: lpType=0x0, lpData=0x53eb48*=0x3, lpcbData=0x53eb44*=0x4) returned 0x0
	[0158.467] RegCloseKey (hKey=0x284) returned 0x0
	[0158.467] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280828
	[0158.467] GetSystemDirectoryW (in: lpBuffer=0x4280828, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0158.467] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x77180000
	[0158.470] GetProcAddress (hModule=0x77180000, lpProcName="DuplicateTokenEx") returned 0x7718ca24
	[0158.470] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.470] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280828
	[0158.470] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280850
	[0158.470] WinMGMTS:IUnknown:Release (This=0x4280810) returned 0x0
	[0158.470] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.471] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x4280850, pbc=0x9e40d0, pszDisplayName="WinMgmts:", pchEaten=0x53ef18, ppmkOut=0x53ef1c | out: pchEaten=0x53ef18*=0x9, ppmkOut=0x53ef1c*=0xa33ab0) returned 0x0
	[0158.471] _wcsnicmp (_String1="WinMgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0
	[0158.472] IBindCtx:GetObjectParam (in: This=0x9e40d0, pszKey="WmiObject", ppunk=0x53ee20 | out: ppunk=0x53ee20*=0x0) returned 0x80004005
	[0158.473] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280860
	[0158.473] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123
	[0158.473] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280880
	[0158.473] CoCreateInstance (in: rclsid=0x6f3e42b0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6f3e42a0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4280898 | out: ppv=0x4280898*=0xa21f28) returned 0x0
	[0158.491] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x42808e8
	[0158.491] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280950
	[0158.491] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x42809b0
	[0158.491] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0158.491] GetCurrentThreadId () returned 0xab8
	[0158.492] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91
	[0158.492] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0158.492] GetCurrentThreadId () returned 0xab8
	[0158.493] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x53ed08 | out: phkResult=0x53ed08*=0x298) returned 0x0
	[0158.493] RegQueryValueExW (in: hKey=0x298, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x53ed10*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x53ed10*=0x16) returned 0x0
	[0158.493] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x42809d0
	[0158.493] RegQueryValueExW (in: hKey=0x298, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x42809d0, lpcbData=0x53ed10*=0x16 | out: lpType=0x0, lpData=0x42809d0*=0x72, lpcbData=0x53ed10*=0x16) returned 0x0
	[0158.493] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x42809f0
	[0158.493] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.493] RegCloseKey (hKey=0x298) returned 0x0
	[0158.494] CoCreateInstance (in: rclsid=0x6f3e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6f3e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x53ed3c | out: ppv=0x53ed3c*=0xa22240) returned 0x0
	[0158.506] SysStringLen (param_1=".") returned 0x1
	[0158.506] WbemDefPath:IWbemPath:SetServer (This=0xa22240, Name=".") returned 0x0
	[0158.507] CoCreateInstance (in: rclsid=0x6f3e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6f3e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x53ecf4 | out: ppv=0x53ecf4*=0xa222b0) returned 0x0
	[0158.507] CoCreateInstance (in: rclsid=0x6f3e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6f3e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x53ec98 | out: ppv=0x53ec98*=0xa22320) returned 0x0
	[0158.507] WbemDefPath:IWbemPath:SetText (This=0xa22320, uMode=0x4, pszPath="root\\cimv2") returned 0x0
	[0158.507] WbemDefPath:IUnknown:Release (This=0xa22320) returned 0x0
	[0158.507] SysStringLen (param_1="root\\cimv2") returned 0xa
	[0158.508] WbemDefPath:IWbemPath:SetText (This=0xa222b0, uMode=0xc, pszPath="root\\cimv2") returned 0x0
	[0158.508] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa222b0, puCount=0x53ed04 | out: puCount=0x53ed04*=0x2) returned 0x0
	[0158.508] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0xa22240) returned 0x0
	[0158.508] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0xa222b0, uIndex=0x0, puNameBufLength=0x53eccc*=0x0, pName=0x0 | out: puNameBufLength=0x53eccc*=0x5, pName=0x0) returned 0x0
	[0158.508] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280810
	[0158.508] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0xa222b0, uIndex=0x0, puNameBufLength=0x53eccc*=0x5, pName="৐ШÄШ\x03" | out: puNameBufLength=0x53eccc*=0x5, pName="root") returned 0x0
	[0158.508] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.508] WbemDefPath:IWbemPath:SetNamespaceAt (This=0xa22240, uIndex=0x0, pszName="root") returned 0x0
	[0158.508] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0xa222b0, uIndex=0x1, puNameBufLength=0x53eccc*=0x0, pName=0x0 | out: puNameBufLength=0x53eccc*=0x6, pName=0x0) returned 0x0
	[0158.509] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280810
	[0158.509] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0xa222b0, uIndex=0x1, puNameBufLength=0x53eccc*=0x6, pName="৐ШÄШ" | out: puNameBufLength=0x53eccc*=0x6, pName="cimv2") returned 0x0
	[0158.509] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.509] WbemDefPath:IWbemPath:SetNamespaceAt (This=0xa22240, uIndex=0x1, pszName="cimv2") returned 0x0
	[0158.509] WbemDefPath:IUnknown:Release (This=0xa222b0) returned 0x0
	[0158.509] WbemDefPath:IWbemPath:GetText (in: This=0xa22240, lFlags=4, puBuffLength=0x53ed20*=0x0, pszText=0x0 | out: puBuffLength=0x53ed20*=0xf, pszText=0x0) returned 0x0
	[0158.509] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280a10
	[0158.509] WbemDefPath:IWbemPath:GetText (in: This=0xa22240, lFlags=4, puBuffLength=0x53ed20*=0xf, pszText="ÄШ৐Ш" | out: puBuffLength=0x53ed20*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0158.510] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.510] WbemDefPath:IUnknown:Release (This=0xa22240) returned 0x0
	[0158.510] WbemLocator:IWbemLocator:ConnectServer (in: This=0xa21f28, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x53eda8 | out: ppNamespace=0x53eda8*=0x9f87f0) returned 0x0
	[0158.686] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280a10
	[0158.687] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280a80
	[0158.687] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280ae0
	[0158.687] WbemLocator:IUnknown:QueryInterface (in: This=0x9f87f0, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ec78 | out: ppvObject=0x53ec78*=0xa3a874) returned 0x0
	[0158.687] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xa3a874, pProxy=0x9f87f0, pAuthnSvc=0x53ec68, pAuthzSvc=0x53ec6c, pServerPrincName=0x0, pAuthnLevel=0x53ec94, pImpLevel=0x53ec90, pAuthInfo=0x0, pCapabilites=0x53ec80 | out: pAuthnSvc=0x53ec68*=0xa, pAuthzSvc=0x53ec6c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x53ec94*=0x6, pImpLevel=0x53ec90*=0x2, pAuthInfo=0x0, pCapabilites=0x53ec80*=0x1) returned 0x0
	[0158.687] WbemLocator:IUnknown:Release (This=0xa3a874) returned 0x1
	[0158.687] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0158.688] GetCurrentThreadId () returned 0xab8
	[0158.688] WbemLocator:IUnknown:QueryInterface (in: This=0x9f87f0, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53eca8 | out: ppvObject=0x53eca8*=0xa3a874) returned 0x0
	[0158.688] WbemLocator:IClientSecurity:CopyProxy (in: This=0xa3a874, pProxy=0x9f87f0, ppCopy=0x53ecac | out: ppCopy=0x53ecac*=0x9f8890) returned 0x0
	[0158.688] WbemLocator:IUnknown:QueryInterface (in: This=0x9f8890, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ebc4 | out: ppvObject=0x53ebc4*=0xa3a874) returned 0x0
	[0158.689] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xa3a874, pProxy=0x9f8890, pAuthnSvc=0x53ebe8, pAuthzSvc=0x53ebd8, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x53ebe8*=0xa, pAuthzSvc=0x53ebd8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0
	[0158.689] WbemLocator:IUnknown:Release (This=0xa3a874) returned 0x3
	[0158.689] WbemLocator:IUnknown:QueryInterface (in: This=0x9f8890, riid=0x6f3e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53eb9c | out: ppvObject=0x53eb9c*=0xa3a894) returned 0x0
	[0158.689] WbemLocator:IUnknown:QueryInterface (in: This=0x9f8890, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53eba0 | out: ppvObject=0x53eba0*=0xa3a874) returned 0x0
	[0158.689] WbemLocator:IClientSecurity:SetBlanket (This=0xa3a874, pProxy=0x9f8890, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0158.689] WbemLocator:IUnknown:Release (This=0xa3a874) returned 0x4
	[0158.689] WbemLocator:IUnknown:Release (This=0xa3a894) returned 0x3
	[0158.689] WbemLocator:IUnknown:Release (This=0xa3a874) returned 0x2
	[0158.690] WbemLocator:IUnknown:AddRef (This=0x9f8890) returned 0x3
	[0158.690] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280b98
	[0158.690] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x42809d0
	[0158.690] WbemLocator:IUnknown:Release (This=0x9f87f0) returned 0x2
	[0158.690] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0158.690] GetCurrentThreadId () returned 0xab8
	[0158.691] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0158.691] GetCurrentThreadId () returned 0xab8
	[0158.691] WbemLocator:IUnknown:QueryInterface (in: This=0x9f8890, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ed6c | out: ppvObject=0x53ed6c*=0xa3a874) returned 0x0
	[0158.691] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xa3a874, pProxy=0x9f8890, pAuthnSvc=0x53ed5c, pAuthzSvc=0x53ed60, pServerPrincName=0x0, pAuthnLevel=0x53ed8c, pImpLevel=0x53ed90, pAuthInfo=0x0, pCapabilites=0x53ed74 | out: pAuthnSvc=0x53ed5c*=0xa, pAuthzSvc=0x53ed60*=0x0, pServerPrincName=0x0, pAuthnLevel=0x53ed8c*=0x6, pImpLevel=0x53ed90*=0x3, pAuthInfo=0x0, pCapabilites=0x53ed74*=0x20) returned 0x0
	[0158.691] WbemLocator:IUnknown:Release (This=0xa3a874) returned 0x2
	[0158.691] CreatePointerMoniker (in: punk=0x4280a10, ppmk=0x53ef1c | out: ppmk=0x53ef1c*=0xa33ab0) returned 0x0
	[0158.691] IUnknown:AddRef (This=0x4280a10) returned 0x2
	[0158.692] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.692] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.692] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.692] WbemLocator:IUnknown:Release (This=0xa21f28) returned 0x0
	[0158.692] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.692] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.692] WinMGMTS:IUnknown:Release (This=0x4280850) returned 0x0
	[0158.693] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0158.695] IUnknown:QueryInterface (in: This=0xa33ab0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ea24 | out: ppvObject=0x53ea24*=0xa33ab0) returned 0x0
	[0158.696] IUnknown:QueryInterface (in: This=0xa33ab0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e9d8 | out: ppvObject=0x53e9d8*=0x0) returned 0x80004002
	[0158.696] IUnknown:QueryInterface (in: This=0xa33ab0, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e800 | out: ppvObject=0x53e800*=0x0) returned 0x80004002
	[0158.696] IUnknown:AddRef (This=0xa33ab0) returned 0x3
	[0158.696] IUnknown:QueryInterface (in: This=0xa33ab0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53e334 | out: ppvObject=0x53e334*=0x0) returned 0x80004002
	[0158.696] IUnknown:QueryInterface (in: This=0xa33ab0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53e2e4 | out: ppvObject=0x53e2e4*=0x0) returned 0x80004002
	[0158.696] IUnknown:QueryInterface (in: This=0xa33ab0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e2f0 | out: ppvObject=0x53e2f0*=0xa33ac4) returned 0x0
	[0158.697] IMarshal:GetUnmarshalClass (in: This=0xa33ac4, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53e2f8 | out: pCid=0x53e2f8*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0158.697] IUnknown:Release (This=0xa33ac4) returned 0x3
	[0158.697] CoGetContextToken (in: pToken=0x53e350 | out: pToken=0x53e350) returned 0x0
	[0158.697] CoGetContextToken (in: pToken=0x53e764 | out: pToken=0x53e764) returned 0x0
	[0158.697] IUnknown:QueryInterface (in: This=0xa33ab0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e7e4 | out: ppvObject=0x53e7e4*=0x0) returned 0x80004002
	[0158.697] IUnknown:Release (This=0xa33ab0) returned 0x2
	[0158.697] CoGetContextToken (in: pToken=0x53ed34 | out: pToken=0x53ed34) returned 0x0
	[0158.697] CoGetContextToken (in: pToken=0x53ec94 | out: pToken=0x53ec94) returned 0x0
	[0158.698] IUnknown:QueryInterface (in: This=0xa33ab0, riid=0x53ed64*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ed60 | out: ppvObject=0x53ed60*=0xa33ab0) returned 0x0
	[0158.698] IUnknown:AddRef (This=0xa33ab0) returned 0x4
	[0158.698] IUnknown:Release (This=0xa33ab0) returned 0x3
	[0158.698] IUnknown:Release (This=0x9e40d0) returned 0x2
	[0158.698] IUnknown:Release (This=0xa33ab0) returned 0x2
	[0158.699] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0158.699] IUnknown:AddRef (This=0xa33ab0) returned 0x3
	[0158.699] BindMoniker (in: pmk=0xa33ab0, grfOpt=0x0, iidResult=0x227c968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x53ef64 | out: ppvResult=0x53ef64*=0x4280a10) returned 0x0
	[0158.699] IUnknown:QueryInterface (in: This=0x4280a10, riid=0x227c968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ef64 | out: ppvObject=0x53ef64*=0x4280a10) returned 0x0
	[0158.703] LoadRegTypeLib (in: rguid=0x6f3e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x53e7d0*=0x0 | out: pptlib=0x53e7d0*=0xa3f530) returned 0x0
	[0158.986] ITypeLib:GetTypeInfoOfGuid (in: This=0xa3f530, GUID=0x4280a54*(Data1=0x62e522dc, Data2=0x8cf3, Data3=0x40a8, Data4=([0]=0x8b, [1]=0x2e, [2]=0x37, [3]=0xd5, [4]=0x95, [5]=0x65, [6]=0x1e, [7]=0x40)), ppTInfo=0x4280a3c | out: ppTInfo=0x4280a3c*=0xa40f84) returned 0x0
	[0158.986] IUnknown:Release (This=0xa3f530) returned 0x1
	[0158.986] IUnknown:AddRef (This=0xa40f84) returned 0x2
	[0158.986] ITypeInfo:RemoteGetTypeAttr (in: This=0xa40f84, ppTypeAttr=0x53e800, pDummy=0x21362660 | out: ppTypeAttr=0x53e800, pDummy=0x21362660) returned 0x0
	[0159.010] ITypeInfo:LocalReleaseTypeAttr (This=0xa40f84) returned 0xa3b740
	[0159.010] IUnknown:Release (This=0xa40f84) returned 0x1
	[0159.010] CoGetContextToken (in: pToken=0x53e354 | out: pToken=0x53e354) returned 0x0
	[0159.011] CoGetContextToken (in: pToken=0x53e764 | out: pToken=0x53e764) returned 0x0
	[0159.011] IUnknown:Release (This=0xa33ab0) returned 0x2
	[0159.129] CoGetContextToken (in: pToken=0x53ea34 | out: pToken=0x53ea34) returned 0x0
	[0159.130] LoadRegTypeLib (in: rguid=0x6f3e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x53ea44*=0x0 | out: pptlib=0x53ea44*=0xa3f530) returned 0x0
	[0159.133] ITypeLib:GetTypeInfoOfGuid (in: This=0xa3f530, GUID=0x4280a44*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x4280a38 | out: ppTInfo=0x4280a38*=0xa40fb0) returned 0x0
	[0159.133] IUnknown:Release (This=0xa3f530) returned 0x2
	[0159.133] IUnknown:AddRef (This=0xa40fb0) returned 0x2
	[0159.133] DispGetIDsOfNames (in: ptinfo=0xa40fb0, rgszNames=0x53eaa0*="InstancesOf", cNames=0x1, rgdispid=0x53ea90 | out: rgdispid=0x53ea90*=5) returned 0x0
	[0159.149] IUnknown:Release (This=0xa40fb0) returned 0x1
	[0159.154] IUnknown:AddRef (This=0xa40fb0) returned 0x2
	[0159.154] ITypeInfo:LocalInvoke (This=0xa40fb0) returned 0x0
	[0159.154] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0159.154] GetCurrentThreadId () returned 0xab8
	[0159.154] WbemLocator:IUnknown:AddRef (This=0x9f8890) returned 0x3
	[0159.154] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0159.154] GetCurrentThreadId () returned 0xab8
	[0159.155] IWbemServices:CreateInstanceEnum (in: This=0x9f8890, strFilter="Win32_BaseBoard", lFlags=16, pCtx=0x0, ppEnum=0x53e6e4 | out: ppEnum=0x53e6e4*=0x9eefe8) returned 0x0
	[0159.187] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280850
	[0159.188] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x42808b0
	[0159.188] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280910
	[0159.188] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280970
	[0159.188] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280bf8
	[0159.189] IUnknown:QueryInterface (in: This=0x9eefe8, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e5fc | out: ppvObject=0x53e5fc*=0x9eefec) returned 0x0
	[0159.189] IClientSecurity:QueryBlanket (in: This=0x9eefec, pProxy=0x9eefe8, pAuthnSvc=0x53e5ec, pAuthzSvc=0x53e5f0, pServerPrincName=0x0, pAuthnLevel=0x53e618, pImpLevel=0x53e614, pAuthInfo=0x0, pCapabilites=0x53e604 | out: pAuthnSvc=0x53e5ec*=0xa, pAuthzSvc=0x53e5f0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x53e618*=0x6, pImpLevel=0x53e614*=0x2, pAuthInfo=0x0, pCapabilites=0x53e604*=0x1) returned 0x0
	[0159.189] IUnknown:Release (This=0x9eefec) returned 0x1
	[0159.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0159.189] GetCurrentThreadId () returned 0xab8
	[0159.190] WbemLocator:IUnknown:QueryInterface (in: This=0x9f8890, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e5e0 | out: ppvObject=0x53e5e0*=0xa3a874) returned 0x0
	[0159.190] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xa3a874, pProxy=0x9f8890, pAuthnSvc=0x53e5d0, pAuthzSvc=0x53e5d4, pServerPrincName=0x0, pAuthnLevel=0x53e600, pImpLevel=0x53e604, pAuthInfo=0x0, pCapabilites=0x53e5e8 | out: pAuthnSvc=0x53e5d0*=0xa, pAuthzSvc=0x53e5d4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x53e600*=0x6, pImpLevel=0x53e604*=0x3, pAuthInfo=0x0, pCapabilites=0x53e5e8*=0x20) returned 0x0
	[0159.190] WbemLocator:IUnknown:Release (This=0xa3a874) returned 0x3
	[0159.190] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0159.190] GetCurrentThreadId () returned 0xab8
	[0159.190] WbemLocator:IUnknown:QueryInterface (in: This=0x9f8890, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e5e0 | out: ppvObject=0x53e5e0*=0xa3a874) returned 0x0
	[0159.190] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xa3a874, pProxy=0x9f8890, pAuthnSvc=0x53e5d0, pAuthzSvc=0x53e5d4, pServerPrincName=0x0, pAuthnLevel=0x53e604, pImpLevel=0x53e600, pAuthInfo=0x0, pCapabilites=0x53e5e8 | out: pAuthnSvc=0x53e5d0*=0xa, pAuthzSvc=0x53e5d4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x53e604*=0x6, pImpLevel=0x53e600*=0x3, pAuthInfo=0x0, pCapabilites=0x53e5e8*=0x20) returned 0x0
	[0159.190] WbemLocator:IUnknown:Release (This=0xa3a874) returned 0x3
	[0159.191] IUnknown:QueryInterface (in: This=0x9eefe8, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e62c | out: ppvObject=0x53e62c*=0x9eefec) returned 0x0
	[0159.191] IClientSecurity:CopyProxy (in: This=0x9eefec, pProxy=0x9eefe8, ppCopy=0x53e630 | out: ppCopy=0x53e630*=0x9ef0b0) returned 0x0
	[0159.192] IUnknown:QueryInterface (in: This=0x9ef0b0, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e548 | out: ppvObject=0x53e548*=0x9ef0b4) returned 0x0
	[0159.192] IClientSecurity:QueryBlanket (in: This=0x9ef0b4, pProxy=0x9ef0b0, pAuthnSvc=0x53e56c, pAuthzSvc=0x53e55c, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x53e56c*=0xa, pAuthzSvc=0x53e55c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0
	[0159.192] IUnknown:Release (This=0x9ef0b4) returned 0x3
	[0159.192] IUnknown:QueryInterface (in: This=0x9ef0b0, riid=0x6f3e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e520 | out: ppvObject=0x53e520*=0xa41c94) returned 0x0
	[0159.192] IUnknown:QueryInterface (in: This=0x9ef0b0, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e524 | out: ppvObject=0x53e524*=0x9ef0b4) returned 0x0
	[0159.192] IClientSecurity:SetBlanket (This=0x9ef0b4, pProxy=0x9ef0b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0159.273] IUnknown:Release (This=0x9ef0b4) returned 0x4
	[0159.273] WbemLocator:IUnknown:Release (This=0xa41c94) returned 0x3
	[0159.273] IUnknown:Release (This=0x9eefec) returned 0x2
	[0159.273] IUnknown:AddRef (This=0x9ef0b0) returned 0x3
	[0159.274] IUnknown:Release (This=0x9eefe8) returned 0x2
	[0159.274] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x53e69c | out: pperrinfo=0x53e69c*=0x0) returned 0x1
	[0159.274] WbemLocator:IUnknown:Release (This=0x9f8890) returned 0x2
	[0159.274] IUnknown:Release (This=0xa40fb0) returned 0x1
	[0159.276] LoadRegTypeLib (in: rguid=0x6f3e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x53e28c*=0x0 | out: pptlib=0x53e28c*=0xa3f530) returned 0x0
	[0159.277] ITypeLib:GetTypeInfoOfGuid (in: This=0xa3f530, GUID=0x4280888*(Data1=0x4b83d61, Data2=0x21ae, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x33, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x4280870 | out: ppTInfo=0x4280870*=0xa410b8) returned 0x0
	[0159.277] IUnknown:Release (This=0xa3f530) returned 0x3
	[0159.277] IUnknown:AddRef (This=0xa410b8) returned 0x2
	[0159.277] ITypeInfo:RemoteGetTypeAttr (in: This=0xa410b8, ppTypeAttr=0x53e2bc, pDummy=0x21362ca4 | out: ppTypeAttr=0x53e2bc, pDummy=0x21362ca4) returned 0x0
	[0159.280] ITypeInfo:LocalReleaseTypeAttr (This=0xa410b8) returned 0xa3b740
	[0159.280] IUnknown:Release (This=0xa410b8) returned 0x1
	[0159.280] CoGetContextToken (in: pToken=0x53de10 | out: pToken=0x53de10) returned 0x0
	[0159.281] CoGetContextToken (in: pToken=0x53e224 | out: pToken=0x53e224) returned 0x0
	[0159.282] CoGetContextToken (in: pToken=0x53ee0c | out: pToken=0x53ee0c) returned 0x0
	[0159.282] CoGetContextToken (in: pToken=0x53ed6c | out: pToken=0x53ed6c) returned 0x0
	[0159.284] CoGetContextToken (in: pToken=0x53ed8c | out: pToken=0x53ed8c) returned 0x0
	[0159.284] LoadRegTypeLib (in: rguid=0x6f3e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x53eda0*=0x0 | out: pptlib=0x53eda0*=0xa3f530) returned 0x0
	[0159.286] ITypeLib:GetTypeInfoOfGuid (in: This=0xa3f530, GUID=0x4280878*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x428086c | out: ppTInfo=0x428086c*=0xa41060) returned 0x0
	[0159.286] IUnknown:Release (This=0xa3f530) returned 0x4
	[0159.286] IUnknown:AddRef (This=0xa41060) returned 0x2
	[0159.286] ITypeInfo:LocalInvoke (This=0xa41060) returned 0x0
	[0159.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0159.286] GetCurrentThreadId () returned 0xab8
	[0159.286] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280810
	[0159.287] IUnknown:Release (This=0xa41060) returned 0x1
	[0159.287] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
	[0160.221] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0xa12960
	[0160.224] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0xa129e8
	[0160.284] CoGetContextToken (in: pToken=0x53ead4 | out: pToken=0x53ead4) returned 0x0
	[0160.291] CoGetContextToken (in: pToken=0x53e5ec | out: pToken=0x53e5ec) returned 0x0
	[0160.291] IUnknown:AddRef (This=0xa41060) returned 0x2
	[0160.291] ITypeInfo:LocalInvoke (This=0xa41060) returned 0x0
	[0160.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.291] GetCurrentThreadId () returned 0xab8
	[0160.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.291] GetCurrentThreadId () returned 0xab8
	[0160.291] IUnknown:AddRef (This=0x9ef0b0) returned 0x3
	[0160.291] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.291] GetCurrentThreadId () returned 0xab8
	[0160.292] IEnumWbemClassObject:Clone (in: This=0x9ef0b0, ppEnum=0x53e840 | out: ppEnum=0x53e840*=0x9ef178) returned 0x0
	[0160.297] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280cb0
	[0160.297] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280d10
	[0160.297] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280d70
	[0160.297] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280990
	[0160.297] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280dd0
	[0160.298] IUnknown:QueryInterface (in: This=0x9ef178, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e758 | out: ppvObject=0x53e758*=0x9ef17c) returned 0x0
	[0160.298] IClientSecurity:QueryBlanket (in: This=0x9ef17c, pProxy=0x9ef178, pAuthnSvc=0x53e748, pAuthzSvc=0x53e74c, pServerPrincName=0x0, pAuthnLevel=0x53e774, pImpLevel=0x53e770, pAuthInfo=0x0, pCapabilites=0x53e760 | out: pAuthnSvc=0x53e748*=0xa, pAuthzSvc=0x53e74c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x53e774*=0x6, pImpLevel=0x53e770*=0x2, pAuthInfo=0x0, pCapabilites=0x53e760*=0x1) returned 0x0
	[0160.298] IUnknown:Release (This=0x9ef17c) returned 0x1
	[0160.298] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.298] GetCurrentThreadId () returned 0xab8
	[0160.298] IUnknown:QueryInterface (in: This=0x9ef0b0, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e73c | out: ppvObject=0x53e73c*=0x9ef0b4) returned 0x0
	[0160.298] IClientSecurity:QueryBlanket (in: This=0x9ef0b4, pProxy=0x9ef0b0, pAuthnSvc=0x53e72c, pAuthzSvc=0x53e730, pServerPrincName=0x0, pAuthnLevel=0x53e75c, pImpLevel=0x53e760, pAuthInfo=0x0, pCapabilites=0x53e744 | out: pAuthnSvc=0x53e72c*=0xa, pAuthzSvc=0x53e730*=0x0, pServerPrincName=0x0, pAuthnLevel=0x53e75c*=0x6, pImpLevel=0x53e760*=0x3, pAuthInfo=0x0, pCapabilites=0x53e744*=0x20) returned 0x0
	[0160.298] IUnknown:Release (This=0x9ef0b4) returned 0x3
	[0160.298] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.298] GetCurrentThreadId () returned 0xab8
	[0160.299] IUnknown:QueryInterface (in: This=0x9ef0b0, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e73c | out: ppvObject=0x53e73c*=0x9ef0b4) returned 0x0
	[0160.299] IClientSecurity:QueryBlanket (in: This=0x9ef0b4, pProxy=0x9ef0b0, pAuthnSvc=0x53e72c, pAuthzSvc=0x53e730, pServerPrincName=0x0, pAuthnLevel=0x53e760, pImpLevel=0x53e75c, pAuthInfo=0x0, pCapabilites=0x53e744 | out: pAuthnSvc=0x53e72c*=0xa, pAuthzSvc=0x53e730*=0x0, pServerPrincName=0x0, pAuthnLevel=0x53e760*=0x6, pImpLevel=0x53e75c*=0x3, pAuthInfo=0x0, pCapabilites=0x53e744*=0x20) returned 0x0
	[0160.299] IUnknown:Release (This=0x9ef0b4) returned 0x3
	[0160.299] IUnknown:QueryInterface (in: This=0x9ef178, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e788 | out: ppvObject=0x53e788*=0x9ef17c) returned 0x0
	[0160.299] IClientSecurity:CopyProxy (in: This=0x9ef17c, pProxy=0x9ef178, ppCopy=0x53e78c | out: ppCopy=0x53e78c*=0x9ef240) returned 0x0
	[0160.299] IUnknown:QueryInterface (in: This=0x9ef240, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e6a4 | out: ppvObject=0x53e6a4*=0x9ef244) returned 0x0
	[0160.300] IClientSecurity:QueryBlanket (in: This=0x9ef244, pProxy=0x9ef240, pAuthnSvc=0x53e6c8, pAuthzSvc=0x53e6b8, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x53e6c8*=0xa, pAuthzSvc=0x53e6b8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0
	[0160.300] IUnknown:Release (This=0x9ef244) returned 0x3
	[0160.300] IUnknown:QueryInterface (in: This=0x9ef240, riid=0x6f3e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e67c | out: ppvObject=0x53e67c*=0x9f71cc) returned 0x0
	[0160.300] IUnknown:QueryInterface (in: This=0x9ef240, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e680 | out: ppvObject=0x53e680*=0x9ef244) returned 0x0
	[0160.300] IClientSecurity:SetBlanket (This=0x9ef244, pProxy=0x9ef240, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0160.308] IUnknown:Release (This=0x9ef244) returned 0x4
	[0160.308] WbemLocator:IUnknown:Release (This=0x9f71cc) returned 0x3
	[0160.308] IUnknown:Release (This=0x9ef17c) returned 0x2
	[0160.308] IUnknown:AddRef (This=0x9ef240) returned 0x3
	[0160.308] IUnknown:Release (This=0x9ef178) returned 0x2
	[0160.309] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x53e7f8 | out: pperrinfo=0x53e7f8*=0x0) returned 0x1
	[0160.309] IUnknown:Release (This=0x9ef0b0) returned 0x2
	[0160.309] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.309] GetCurrentThreadId () returned 0xab8
	[0160.309] IUnknown:AddRef (This=0x9ef240) returned 0x3
	[0160.309] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.309] GetCurrentThreadId () returned 0xab8
	[0160.310] IEnumWbemClassObject:Reset (This=0x9ef240) returned 0x0
	[0160.324] IUnknown:Release (This=0x9ef240) returned 0x2
	[0160.324] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280810
	[0160.324] IUnknown:Release (This=0xa41060) returned 0x1
	[0160.326] CoGetContextToken (in: pToken=0x53ddb8 | out: pToken=0x53ddb8) returned 0x0
	[0160.326] CoGetContextToken (in: pToken=0x53e1cc | out: pToken=0x53e1cc) returned 0x0
	[0160.341] CoGetContextToken (in: pToken=0x53ebac | out: pToken=0x53ebac) returned 0x0
	[0160.341] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.341] GetCurrentThreadId () returned 0xab8
	[0160.342] IUnknown:AddRef (This=0x9ef240) returned 0x3
	[0160.342] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.342] GetCurrentThreadId () returned 0xab8
	[0160.342] IEnumWbemClassObject:Next (in: This=0x9ef240, lTimeout=-1, uCount=0x1, apObjects=0x53ef30, puReturned=0x53ef28 | out: apObjects=0x53ef30*=0xa549a8, puReturned=0x53ef28*=0x1) returned 0x0
	[0160.348] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280e88
	[0160.348] IUnknown:AddRef (This=0xa549a8) returned 0x2
	[0160.348] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280ed0
	[0160.348] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280f40
	[0160.349] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4280fa0
	[0160.349] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x42809b0
	[0160.349] WbemLocator:IUnknown:AddRef (This=0x9f8890) returned 0x3
	[0160.349] IUnknown:AddRef (This=0x9ef240) returned 0x4
	[0160.349] IUnknown:QueryInterface (in: This=0x9ef240, riid=0x6f3e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ee90 | out: ppvObject=0x53ee90*=0x9ef244) returned 0x0
	[0160.350] IClientSecurity:QueryBlanket (in: This=0x9ef244, pProxy=0x9ef240, pAuthnSvc=0x53ee80, pAuthzSvc=0x53ee84, pServerPrincName=0x0, pAuthnLevel=0x53eea0, pImpLevel=0x53eeac, pAuthInfo=0x0, pCapabilites=0x53ee98 | out: pAuthnSvc=0x53ee80*=0xa, pAuthzSvc=0x53ee84*=0x0, pServerPrincName=0x0, pAuthnLevel=0x53eea0*=0x6, pImpLevel=0x53eeac*=0x3, pAuthInfo=0x0, pCapabilites=0x53ee98*=0x20) returned 0x0
	[0160.350] IUnknown:Release (This=0x9ef244) returned 0x4
	[0160.350] WbemLocator:IUnknown:Release (This=0x9f8890) returned 0x2
	[0160.350] WbemLocator:IUnknown:AddRef (This=0x9f8890) returned 0x3
	[0160.350] IUnknown:Release (This=0x9ef240) returned 0x3
	[0160.350] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe
	[0160.350] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4281000
	[0160.350] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4281030
	[0160.350] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4281050
	[0160.350] IUnknown:AddRef (This=0xa549a8) returned 0x3
	[0160.350] IUnknown:Release (This=0xa549a8) returned 0x2
	[0160.350] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x53eee4 | out: pperrinfo=0x53eee4*=0x0) returned 0x1
	[0160.351] IUnknown:Release (This=0x9ef240) returned 0x2
	[0160.351] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x53ef28 | out: pperrinfo=0x53ef28*=0x0) returned 0x1
	[0160.478] LoadRegTypeLib (in: rguid=0x6f3e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x53e6f4*=0x0 | out: pptlib=0x53e6f4*=0xa3f530) returned 0x0
	[0160.480] ITypeLib:GetTypeInfoOfGuid (in: This=0xa3f530, GUID=0x6f3f70c4*(Data1=0xd6bdafb2, Data2=0x9435, Data3=0x491f, Data4=([0]=0xbb, [1]=0x87, [2]=0x6a, [3]=0xa0, [4]=0xf0, [5]=0xbc, [6]=0x31, [7]=0xa2)), ppTInfo=0x428101c | out: ppTInfo=0x428101c*=0xa410e4) returned 0x0
	[0160.480] IUnknown:Release (This=0xa3f530) returned 0x5
	[0160.480] IUnknown:AddRef (This=0xa410e4) returned 0x2
	[0160.480] ITypeInfo:RemoteGetTypeAttr (in: This=0xa410e4, ppTypeAttr=0x53e734, pDummy=0x2136291c | out: ppTypeAttr=0x53e734, pDummy=0x2136291c) returned 0x0
	[0160.483] ITypeInfo:LocalReleaseTypeAttr (This=0xa410e4) returned 0xa3b740
	[0160.483] IUnknown:Release (This=0xa410e4) returned 0x1
	[0160.484] CoGetContextToken (in: pToken=0x53e288 | out: pToken=0x53e288) returned 0x0
	[0160.484] CoGetContextToken (in: pToken=0x53e69c | out: pToken=0x53e69c) returned 0x0
	[0160.490] CoGetContextToken (in: pToken=0x53ea54 | out: pToken=0x53ea54) returned 0x0
	[0160.491] LoadRegTypeLib (in: rguid=0x6f3e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x53ea48*=0x0 | out: pptlib=0x53ea48*=0xa3f530) returned 0x0
	[0160.492] ITypeLib:GetTypeInfoOfGuid (in: This=0xa3f530, GUID=0x6f3e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4281018 | out: ppTInfo=0x4281018*=0xa41110) returned 0x0
	[0160.492] IUnknown:Release (This=0xa3f530) returned 0x6
	[0160.492] IUnknown:AddRef (This=0xa41110) returned 0x2
	[0160.492] DispGetIDsOfNames (in: ptinfo=0xa41110, rgszNames=0x53eac0*="SerialNumber", cNames=0x1, rgdispid=0x53eab0 | out: rgdispid=0x53eab0*=-1) returned 0x80020006
	[0160.553] IUnknown:AddRef (This=0xa549a8) returned 0x3
	[0160.553] IWbemClassObject:Get (in: This=0xa549a8, wszName="SerialNumber", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x53e9d0*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x53e9d0*=0) returned 0x0
	[0160.553] IUnknown:Release (This=0xa549a8) returned 0x2
	[0160.554] SysStringLen (param_1="SerialNumber") returned 0xc
	[0160.554] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4281078
	[0160.554] SysStringLen (param_1="SerialNumber") returned 0xc
	[0160.554] IUnknown:Release (This=0xa41110) returned 0x1
	[0160.554] IUnknown:AddRef (This=0xa41110) returned 0x2
	[0160.554] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.554] GetCurrentThreadId () returned 0xab8
	[0160.554] SysStringLen (param_1="SerialNumber") returned 0xc
	[0160.554] IWbemClassObject:Get (in: This=0xa549a8, wszName="SerialNumber", lFlags=0, pVal=0x53e850*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e888, varVal2=0x6f3e2d81), pType=0x53e860*=1866345862, plFlavor=0x0 | out: pVal=0x53e850*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..CN747510BO0504.", varVal2=0x6f3e2d81), pType=0x53e860*=8, plFlavor=0x0) returned 0x0
	[0160.555] IUnknown:Release (This=0xa41110) returned 0x1
	[0160.556] SysStringByteLen (bstr="..CN747510BO0504.") returned 0x22
	[0160.556] SysStringByteLen (bstr="..CN747510BO0504.") returned 0x22
	[0160.589] CoGetContextToken (in: pToken=0x53ebac | out: pToken=0x53ebac) returned 0x0
	[0160.590] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.590] GetCurrentThreadId () returned 0xab8
	[0160.590] IUnknown:AddRef (This=0x9ef240) returned 0x3
	[0160.590] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
	[0160.590] GetCurrentThreadId () returned 0xab8
	[0160.590] IEnumWbemClassObject:Next (in: This=0x9ef240, lTimeout=-1, uCount=0x1, apObjects=0x53ef30, puReturned=0x53ef28 | out: apObjects=0x53ef30*=0x0, puReturned=0x53ef28*=0x0) returned 0x1
	[0160.594] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x53eee4 | out: pperrinfo=0x53eee4*=0x0) returned 0x1
	[0160.594] IUnknown:Release (This=0x9ef240) returned 0x2
	[0160.594] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x53ef28 | out: pperrinfo=0x53ef28*=0x0) returned 0x1
	[0160.724] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c0
	[0160.725] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c4
	[0160.770] SetEvent (hEvent=0x2c4) returned 1
	[0160.806] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53ef18*=0x2c0, lpdwindex=0x53ed3c | out: lpdwindex=0x53ed3c) returned 0x0
	[0160.828] CoGetContextToken (in: pToken=0x53edec | out: pToken=0x53edec) returned 0x0
	[0160.828] CoGetContextToken (in: pToken=0x53ed4c | out: pToken=0x53ed4c) returned 0x0
	[0160.828] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22400, riid=0x53ee1c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53ee18 | out: ppvObject=0x53ee18*=0xa22400) returned 0x0
	[0160.828] WbemDefPath:IUnknown:AddRef (This=0xa22400) returned 0x3
	[0160.829] WbemDefPath:IUnknown:Release (This=0xa22400) returned 0x2
	[0160.831] WbemDefPath:IWbemPath:SetText (This=0xa22400, uMode=0x4, pszPath="win32_processor") returned 0x0
	[0160.833] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22400, puCount=0x53ef98 | out: puCount=0x53ef98*=0x0) returned 0x0
	[0160.833] WbemDefPath:IWbemPath:GetText (in: This=0xa22400, lFlags=2, puBuffLength=0x53ef94*=0x0, pszText=0x0 | out: puBuffLength=0x53ef94*=0x10, pszText=0x0) returned 0x0
	[0160.834] WbemDefPath:IWbemPath:GetText (in: This=0xa22400, lFlags=2, puBuffLength=0x53ef94*=0x10, pszText="000000000000000" | out: puBuffLength=0x53ef94*=0x10, pszText="win32_processor") returned 0x0
	[0160.835] WbemDefPath:IWbemPath:GetInfo (in: This=0xa22400, uRequestedInfo=0x0, puResponse=0x53efa0 | out: puResponse=0x53efa0*=0xc15) returned 0x0
	[0160.835] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22400, puCount=0x53ef98 | out: puCount=0x53ef98*=0x0) returned 0x0
	[0160.835] WbemDefPath:IWbemPath:GetInfo (in: This=0xa22400, uRequestedInfo=0x0, puResponse=0x53efa0 | out: puResponse=0x53efa0*=0xc15) returned 0x0
	[0160.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22400, puCount=0x53ef88 | out: puCount=0x53ef88*=0x0) returned 0x0
	[0160.836] WbemDefPath:IWbemPath:GetText (in: This=0xa22400, lFlags=2, puBuffLength=0x53ef84*=0x0, pszText=0x0 | out: puBuffLength=0x53ef84*=0x10, pszText=0x0) returned 0x0
	[0160.837] WbemDefPath:IWbemPath:GetText (in: This=0xa22400, lFlags=2, puBuffLength=0x53ef84*=0x10, pszText="000000000000000" | out: puBuffLength=0x53ef84*=0x10, pszText="win32_processor") returned 0x0
	[0160.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22400, puCount=0x53ef88 | out: puCount=0x53ef88*=0x0) returned 0x0
	[0160.837] WbemDefPath:IWbemPath:GetText (in: This=0xa22400, lFlags=2, puBuffLength=0x53ef84*=0x0, pszText=0x0 | out: puBuffLength=0x53ef84*=0x10, pszText=0x0) returned 0x0
	[0160.837] WbemDefPath:IWbemPath:GetText (in: This=0xa22400, lFlags=2, puBuffLength=0x53ef84*=0x10, pszText="000000000000000" | out: puBuffLength=0x53ef84*=0x10, pszText="win32_processor") returned 0x0
	[0160.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22400, puCount=0x53ef18 | out: puCount=0x53ef18*=0x0) returned 0x0
	[0160.839] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2f4
	[0160.839] SetEvent (hEvent=0x2c4) returned 1
	[0160.839] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53e774*=0x2f4, lpdwindex=0x53e598 | out: lpdwindex=0x53e598) returned 0x0
	[0160.843] CoGetContextToken (in: pToken=0x53e64c | out: pToken=0x53e64c) returned 0x0
	[0160.843] CoGetContextToken (in: pToken=0x53e5ac | out: pToken=0x53e5ac) returned 0x0
	[0160.843] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22470, riid=0x53e67c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53e678 | out: ppvObject=0x53e678*=0xa22470) returned 0x0
	[0160.843] WbemDefPath:IUnknown:AddRef (This=0xa22470) returned 0x3
	[0160.843] WbemDefPath:IUnknown:Release (This=0xa22470) returned 0x2
	[0160.843] WbemDefPath:IWbemPath:SetText (This=0xa22470, uMode=0x4, pszPath="//./root/cimv2") returned 0x0
	[0160.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ef04 | out: puCount=0x53ef04*=0x2) returned 0x0
	[0160.844] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ef00*=0x0, pszText=0x0 | out: puBuffLength=0x53ef00*=0xf, pszText=0x0) returned 0x0
	[0160.844] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ef00*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef00*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0160.844] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2f8
	[0160.844] SetEvent (hEvent=0x2c4) returned 1
	[0160.844] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53ee60*=0x2f8, lpdwindex=0x53ec84 | out: lpdwindex=0x53ec84) returned 0x0
	[0160.848] CoGetContextToken (in: pToken=0x53ed34 | out: pToken=0x53ed34) returned 0x0
	[0160.848] CoGetContextToken (in: pToken=0x53ec94 | out: pToken=0x53ec94) returned 0x0
	[0160.848] WbemDefPath:IUnknown:QueryInterface (in: This=0xa224e0, riid=0x53ed64*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53ed60 | out: ppvObject=0x53ed60*=0xa224e0) returned 0x0
	[0160.848] WbemDefPath:IUnknown:AddRef (This=0xa224e0) returned 0x3
	[0160.848] WbemDefPath:IUnknown:Release (This=0xa224e0) returned 0x2
	[0160.848] WbemDefPath:IWbemPath:SetText (This=0xa224e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0
	[0160.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa224e0, puCount=0x53eedc | out: puCount=0x53eedc*=0x2) returned 0x0
	[0160.849] WbemDefPath:IWbemPath:GetText (in: This=0xa224e0, lFlags=4, puBuffLength=0x53eed8*=0x0, pszText=0x0 | out: puBuffLength=0x53eed8*=0xf, pszText=0x0) returned 0x0
	[0160.849] WbemDefPath:IWbemPath:GetText (in: This=0xa224e0, lFlags=4, puBuffLength=0x53eed8*=0xf, pszText="00000000000000" | out: puBuffLength=0x53eed8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0160.865] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53edfc*=0x30c, lpdwindex=0x53ecb4 | out: lpdwindex=0x53ecb4) returned 0x0
	[0163.030] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa224e0, puCount=0x53ef00 | out: puCount=0x53ef00*=0x2) returned 0x0
	[0163.030] WbemDefPath:IWbemPath:GetText (in: This=0xa224e0, lFlags=4, puBuffLength=0x53eefc*=0x0, pszText=0x0 | out: puBuffLength=0x53eefc*=0xf, pszText=0x0) returned 0x0
	[0163.030] WbemDefPath:IWbemPath:GetText (in: This=0xa224e0, lFlags=4, puBuffLength=0x53eefc*=0xf, pszText="00000000000000" | out: puBuffLength=0x53eefc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0163.030] WbemDefPath:IWbemPath:GetText (in: This=0xa22400, lFlags=2, puBuffLength=0x53ef04*=0x0, pszText=0x0 | out: puBuffLength=0x53ef04*=0x10, pszText=0x0) returned 0x0
	[0163.030] WbemDefPath:IWbemPath:GetText (in: This=0xa22400, lFlags=2, puBuffLength=0x53ef04*=0x10, pszText="000000000000000" | out: puBuffLength=0x53ef04*=0x10, pszText="win32_processor") returned 0x0
	[0163.034] CoGetContextToken (in: pToken=0x53eca4 | out: pToken=0x53eca4) returned 0x0
	[0163.034] CoGetContextToken (in: pToken=0x53ec04 | out: pToken=0x53ec04) returned 0x0
	[0163.034] CoGetContextToken (in: pToken=0x53ec04 | out: pToken=0x53ec04) returned 0x0
	[0163.034] CoGetContextToken (in: pToken=0x53eba4 | out: pToken=0x53eba4) returned 0x0
	[0163.034] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x72588ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53eb7c | out: ppvObject=0x53eb7c*=0x9f1eb0) returned 0x0
	[0163.035] CObjectContext::ContextCallback () returned 0x0
	[0163.115] IUnknown:Release (This=0x9f1eb0) returned 0x1
	[0163.117] CoUnmarshalInterface (in: pStm=0xa2b490, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53ebf8 | out: ppv=0x53ebf8*=0xa5a8e4) returned 0x0
	[0163.117] CoMarshalInterface (pStm=0xa2b490, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa5a8e4, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
	[0163.118] WbemLocator:IUnknown:QueryInterface (in: This=0xa5a8e4, riid=0x53ecd4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x53ecd0 | out: ppvObject=0x53ecd0*=0xa521c8) returned 0x0
	[0163.198] WbemLocator:IUnknown:Release (This=0xa5a8e4) returned 0x1
	[0163.199] IWbemServices:GetObject (in: This=0xa521c8, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x53eeb8*=0x0, ppCallResult=0x0 | out: ppObject=0x53eeb8*=0xa734d0, ppCallResult=0x0) returned 0x0
	[0163.222] WbemLocator:IUnknown:Release (This=0xa521c8) returned 0x0
	[0163.222] IWbemClassObject:Get (in: This=0xa734d0, wszName="__PATH", lFlags=0, pVal=0x53eea0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53ef48*=0, plFlavor=0x53ef44*=0 | out: pVal=0x53eea0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Processor", varVal2=0x0), pType=0x53ef48*=8, plFlavor=0x53ef44*=64) returned 0x0
	[0163.223] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Processor") returned 0x4e
	[0163.223] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Processor") returned 0x4e
	[0163.224] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x34c
	[0163.224] SetEvent (hEvent=0x2c4) returned 1
	[0163.225] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53ee5c*=0x34c, lpdwindex=0x53ec80 | out: lpdwindex=0x53ec80) returned 0x0
	[0163.229] CoGetContextToken (in: pToken=0x53ed34 | out: pToken=0x53ed34) returned 0x0
	[0163.230] CoGetContextToken (in: pToken=0x53ec94 | out: pToken=0x53ec94) returned 0x0
	[0163.230] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22550, riid=0x53ed64*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53ed60 | out: ppvObject=0x53ed60*=0xa22550) returned 0x0
	[0163.230] WbemDefPath:IUnknown:AddRef (This=0xa22550) returned 0x3
	[0163.230] WbemDefPath:IUnknown:Release (This=0xa22550) returned 0x2
	[0163.230] WbemDefPath:IWbemPath:SetText (This=0xa22550, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Processor") returned 0x0
	[0163.230] IWbemClassObject:Get (in: This=0xa734d0, wszName="__CLASS", lFlags=0, pVal=0x53ef10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53ef90*=0, plFlavor=0x53ef8c*=0 | out: pVal=0x53ef10*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Processor", varVal2=0x0), pType=0x53ef90*=8, plFlavor=0x53ef8c*=64) returned 0x0
	[0163.230] SysStringByteLen (bstr="Win32_Processor") returned 0x1e
	[0163.230] SysStringByteLen (bstr="Win32_Processor") returned 0x1e
	[0163.231] CoGetContextToken (in: pToken=0x53ed34 | out: pToken=0x53ed34) returned 0x0
	[0163.231] CoGetContextToken (in: pToken=0x53ec94 | out: pToken=0x53ec94) returned 0x0
	[0163.231] CoGetContextToken (in: pToken=0x53ec94 | out: pToken=0x53ec94) returned 0x0
	[0163.231] CoUnmarshalInterface (in: pStm=0xa2b490, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53ec88 | out: ppv=0x53ec88*=0xa5a8e4) returned 0x0
	[0163.232] CoMarshalInterface (pStm=0xa2b490, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa5a8e4, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
	[0163.232] WbemLocator:IUnknown:QueryInterface (in: This=0xa5a8e4, riid=0x53ed64*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x53ed60 | out: ppvObject=0x53ed60*=0xa522b8) returned 0x0
	[0163.233] WbemLocator:IUnknown:Release (This=0xa5a8e4) returned 0x1
	[0163.233] IWbemServices:CreateInstanceEnum (in: This=0xa522b8, strFilter="Win32_Processor", lFlags=17, pCtx=0x0, ppEnum=0x53ef0c | out: ppEnum=0x53ef0c*=0x9ef3d0) returned 0x0
	[0163.292] IUnknown:QueryInterface (in: This=0x9ef3d0, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ed98 | out: ppvObject=0x53ed98*=0x9ef3d4) returned 0x0
	[0163.293] IClientSecurity:QueryBlanket (in: This=0x9ef3d4, pProxy=0x9ef3d0, pAuthnSvc=0x53ede8, pAuthzSvc=0x53ede4, pServerPrincName=0x53eddc, pAuthnLevel=0x53ede0, pImpLevel=0x53edd0, pAuthInfo=0x53edd4, pCapabilites=0x53edd8 | out: pAuthnSvc=0x53ede8*=0xa, pAuthzSvc=0x53ede4*=0x0, pServerPrincName=0x53eddc, pAuthnLevel=0x53ede0*=0x6, pImpLevel=0x53edd0*=0x2, pAuthInfo=0x53edd4, pCapabilites=0x53edd8*=0x1) returned 0x0
	[0163.293] IUnknown:Release (This=0x9ef3d4) returned 0x1
	[0163.293] IUnknown:QueryInterface (in: This=0x9ef3d0, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ed8c | out: ppvObject=0x53ed8c*=0xa5a9d4) returned 0x0
	[0163.293] IUnknown:QueryInterface (in: This=0x9ef3d0, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ed78 | out: ppvObject=0x53ed78*=0x9ef3d4) returned 0x0
	[0163.293] IClientSecurity:SetBlanket (This=0x9ef3d4, pProxy=0x9ef3d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0163.377] IUnknown:Release (This=0x9ef3d4) returned 0x2
	[0163.378] WbemLocator:IUnknown:Release (This=0xa5a9d4) returned 0x1
	[0163.378] CoTaskMemFree (pv=0xa53648) 
	[0163.378] IUnknown:AddRef (This=0x9ef3d0) returned 0x2
	[0163.379] CoGetContextToken (in: pToken=0x53e2b4 | out: pToken=0x53e2b4) returned 0x0
	[0163.379] CoGetContextToken (in: pToken=0x53e6c4 | out: pToken=0x53e6c4) returned 0x0
	[0163.379] IUnknown:QueryInterface (in: This=0x9ef3d0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e660 | out: ppvObject=0x53e660*=0xa5a9bc) returned 0x0
	[0163.380] WbemLocator:IRpcOptions:Query (in: This=0xa5a9bc, pPrx=0xa5d1f8, dwProperty=2, pdwValue=0x53e754 | out: pdwValue=0x53e754) returned 0x80004002
	[0163.380] WbemLocator:IUnknown:Release (This=0xa5a9bc) returned 0x2
	[0163.380] CoGetContextToken (in: pToken=0x53ec94 | out: pToken=0x53ec94) returned 0x0
	[0163.380] CoGetContextToken (in: pToken=0x53ebf4 | out: pToken=0x53ebf4) returned 0x0
	[0163.380] IUnknown:QueryInterface (in: This=0x9ef3d0, riid=0x53ecc4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x53eb90 | out: ppvObject=0x53eb90*=0x9ef3d0) returned 0x0
	[0163.381] IUnknown:Release (This=0x9ef3d0) returned 0x2
	[0163.381] WbemLocator:IUnknown:Release (This=0xa522b8) returned 0x0
	[0163.381] SysStringLen (param_1=0x0) returned 0x0
	[0163.382] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa224e0, puCount=0x53ef48 | out: puCount=0x53ef48*=0x2) returned 0x0
	[0163.382] WbemDefPath:IWbemPath:GetText (in: This=0xa224e0, lFlags=4, puBuffLength=0x53ef44*=0x0, pszText=0x0 | out: puBuffLength=0x53ef44*=0xf, pszText=0x0) returned 0x0
	[0163.382] WbemDefPath:IWbemPath:GetText (in: This=0xa224e0, lFlags=4, puBuffLength=0x53ef44*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef44*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0163.382] CoGetContextToken (in: pToken=0x53ed94 | out: pToken=0x53ed94) returned 0x0
	[0163.383] IEnumWbemClassObject:Clone (in: This=0x9ef3d0, ppEnum=0x53ef48 | out: ppEnum=0x53ef48*=0x9ef498) returned 0x0
	[0163.450] IUnknown:QueryInterface (in: This=0x9ef498, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ee04 | out: ppvObject=0x53ee04*=0x9ef49c) returned 0x0
	[0163.450] IClientSecurity:QueryBlanket (in: This=0x9ef49c, pProxy=0x9ef498, pAuthnSvc=0x53ee54, pAuthzSvc=0x53ee50, pServerPrincName=0x53ee48, pAuthnLevel=0x53ee4c, pImpLevel=0x53ee3c, pAuthInfo=0x53ee40, pCapabilites=0x53ee44 | out: pAuthnSvc=0x53ee54*=0xa, pAuthzSvc=0x53ee50*=0x0, pServerPrincName=0x53ee48, pAuthnLevel=0x53ee4c*=0x6, pImpLevel=0x53ee3c*=0x2, pAuthInfo=0x53ee40, pCapabilites=0x53ee44*=0x1) returned 0x0
	[0163.450] IUnknown:Release (This=0x9ef49c) returned 0x1
	[0163.450] IUnknown:QueryInterface (in: This=0x9ef498, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa5a8e4) returned 0x0
	[0163.450] IUnknown:QueryInterface (in: This=0x9ef498, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ede4 | out: ppvObject=0x53ede4*=0x9ef49c) returned 0x0
	[0163.450] IClientSecurity:SetBlanket (This=0x9ef49c, pProxy=0x9ef498, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0163.507] IUnknown:Release (This=0x9ef49c) returned 0x2
	[0163.507] WbemLocator:IUnknown:Release (This=0xa5a8e4) returned 0x1
	[0163.507] CoTaskMemFree (pv=0xa53618) 
	[0163.507] IUnknown:AddRef (This=0x9ef498) returned 0x2
	[0163.508] CoGetContextToken (in: pToken=0x53e314 | out: pToken=0x53e314) returned 0x0
	[0163.508] CoGetContextToken (in: pToken=0x53e724 | out: pToken=0x53e724) returned 0x0
	[0163.508] IUnknown:QueryInterface (in: This=0x9ef498, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e6c0 | out: ppvObject=0x53e6c0*=0xa5a8cc) returned 0x0
	[0163.508] WbemLocator:IRpcOptions:Query (in: This=0xa5a8cc, pPrx=0xa6d460, dwProperty=2, pdwValue=0x53e7b4 | out: pdwValue=0x53e7b4) returned 0x80004002
	[0163.508] WbemLocator:IUnknown:Release (This=0xa5a8cc) returned 0x2
	[0163.508] CoGetContextToken (in: pToken=0x53ecf4 | out: pToken=0x53ecf4) returned 0x0
	[0163.508] CoGetContextToken (in: pToken=0x53ec54 | out: pToken=0x53ec54) returned 0x0
	[0163.508] IUnknown:QueryInterface (in: This=0x9ef498, riid=0x53ed24*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x53ebf0 | out: ppvObject=0x53ebf0*=0x9ef498) returned 0x0
	[0163.508] IUnknown:Release (This=0x9ef498) returned 0x2
	[0163.509] SysStringLen (param_1=0x0) returned 0x0
	[0163.509] IEnumWbemClassObject:Reset (This=0x9ef498) returned 0x0
	[0163.640] CoTaskMemAlloc (cb=0x4) returned 0xa49988
	[0163.640] IEnumWbemClassObject:Next (in: This=0x9ef498, lTimeout=-1, uCount=0x1, apObjects=0xa49988, puReturned=0x22c4108 | out: apObjects=0xa49988*=0x0, puReturned=0x22c4108*=0x0) returned 0x80041001
	[0163.682] CoTaskMemFree (pv=0xa49988) 
	[0163.682] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x53ef24 | out: pperrinfo=0x53ef24*=0xa764c4) returned 0x0
	[0163.683] IUnknown:QueryInterface (in: This=0xa764c4, riid=0x6cf232e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ef20 | out: ppvObject=0x53ef20*=0xa764bc) returned 0x0
	[0163.683] IMarshal:GetUnmarshalClass (in: This=0xa764bc, riid=0x6cf23358*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53ef28 | out: pCid=0x53ef28*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0163.683] IUnknown:Release (This=0xa764bc) returned 0x1
	[0163.685] IUnknown:QueryInterface (in: This=0xa764c4, riid=0x22c4184*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53ef78 | out: ppvObject=0x53ef78*=0xa764b8) returned 0x0
	[0163.686] IUnknown:Release (This=0xa764c4) returned 0x1
	[0163.687] IIDFromString (in: lpsz="{EB87E1BD-3233-11D2-AEC9-00C04FB68820}", lpiid=0x53ee6c | out: lpiid=0x53ee6c) returned 0x0
	[0163.689] CoGetClassObject (in: rclsid=0xa53624*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53eb88 | out: ppv=0x53eb88*=0xa49988) returned 0x0
	[0163.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0xa49988, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53eda0 | out: ppvObject=0x53eda0*=0x0) returned 0x80004002
	[0163.692] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0xa49988, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53edac | out: ppvObject=0x53edac*=0xa49998) returned 0x0
	[0163.692] WbemStatusCodeText:IUnknown:Release (This=0xa49988) returned 0x0
	[0163.692] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0xa49998, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e9cc | out: ppvObject=0x53e9cc*=0xa49998) returned 0x0
	[0163.692] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0xa49998, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e980 | out: ppvObject=0x53e980*=0x0) returned 0x80004002
	[0163.692] WbemStatusCodeText:IUnknown:AddRef (This=0xa49998) returned 0x3
	[0163.692] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0xa49998, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53e2dc | out: ppvObject=0x53e2dc*=0x0) returned 0x80004002
	[0163.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0xa49998, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53e28c | out: ppvObject=0x53e28c*=0x0) returned 0x80004002
	[0163.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0xa49998, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e298 | out: ppvObject=0x53e298*=0x0) returned 0x80004002
	[0163.693] CoGetContextToken (in: pToken=0x53e2f8 | out: pToken=0x53e2f8) returned 0x0
	[0163.693] CoGetContextToken (in: pToken=0x53e70c | out: pToken=0x53e70c) returned 0x0
	[0163.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0xa49998, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e78c | out: ppvObject=0x53e78c*=0x0) returned 0x80004002
	[0163.693] WbemStatusCodeText:IUnknown:Release (This=0xa49998) returned 0x2
	[0163.693] WbemStatusCodeText:IUnknown:Release (This=0xa49998) returned 0x1
	[0163.693] CoGetContextToken (in: pToken=0x53ed84 | out: pToken=0x53ed84) returned 0x0
	[0163.693] CoGetContextToken (in: pToken=0x53ece4 | out: pToken=0x53ece4) returned 0x0
	[0163.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0xa49998, riid=0x53edb4*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x53edb0 | out: ppvObject=0x53edb0*=0xa49998) returned 0x0
	[0163.693] WbemStatusCodeText:IUnknown:AddRef (This=0xa49998) returned 0x3
	[0163.694] WbemStatusCodeText:IUnknown:Release (This=0xa49998) returned 0x2
	[0163.694] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0xa49998, hRes=0x80041001, LocaleId=0x0, lFlags=1, MessageText=0x53ef18 | out: MessageText=0x53ef18*="Generic failure ") returned 0x0
	[0163.753] SysStringByteLen (bstr="Generic failure ") returned 0x20
	[0163.922] CoGetContextToken (in: pToken=0x53dc44 | out: pToken=0x53dc44) returned 0x0
	[0163.922] IUnknown:Release (This=0x9ef498) returned 0x1
	[0163.922] IUnknown:Release (This=0x9ef498) returned 0x0
	[0164.241] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x354
	[0164.242] SetEvent (hEvent=0x2c4) returned 1
	[0164.242] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53ef18*=0x354, lpdwindex=0x53ed3c | out: lpdwindex=0x53ed3c) returned 0x0
	[0164.316] CoGetContextToken (in: pToken=0x53edec | out: pToken=0x53edec) returned 0x0
	[0164.316] CoGetContextToken (in: pToken=0x53ed4c | out: pToken=0x53ed4c) returned 0x0
	[0164.316] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22630, riid=0x53ee1c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53ee18 | out: ppvObject=0x53ee18*=0xa22630) returned 0x0
	[0164.316] WbemDefPath:IUnknown:AddRef (This=0xa22630) returned 0x3
	[0164.316] WbemDefPath:IUnknown:Release (This=0xa22630) returned 0x2
	[0164.316] WbemDefPath:IWbemPath:SetText (This=0xa22630, uMode=0x4, pszPath="Win32_NetworkAdapterConfiguration") returned 0x0
	[0164.316] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22630, puCount=0x53ef98 | out: puCount=0x53ef98*=0x0) returned 0x0
	[0164.316] WbemDefPath:IWbemPath:GetText (in: This=0xa22630, lFlags=2, puBuffLength=0x53ef94*=0x0, pszText=0x0 | out: puBuffLength=0x53ef94*=0x22, pszText=0x0) returned 0x0
	[0164.316] WbemDefPath:IWbemPath:GetText (in: This=0xa22630, lFlags=2, puBuffLength=0x53ef94*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x53ef94*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0
	[0164.316] WbemDefPath:IWbemPath:GetInfo (in: This=0xa22630, uRequestedInfo=0x0, puResponse=0x53efa0 | out: puResponse=0x53efa0*=0xc15) returned 0x0
	[0164.316] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22630, puCount=0x53ef98 | out: puCount=0x53ef98*=0x0) returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetInfo (in: This=0xa22630, uRequestedInfo=0x0, puResponse=0x53efa0 | out: puResponse=0x53efa0*=0xc15) returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22630, puCount=0x53ef88 | out: puCount=0x53ef88*=0x0) returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetText (in: This=0xa22630, lFlags=2, puBuffLength=0x53ef84*=0x0, pszText=0x0 | out: puBuffLength=0x53ef84*=0x22, pszText=0x0) returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetText (in: This=0xa22630, lFlags=2, puBuffLength=0x53ef84*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x53ef84*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22630, puCount=0x53ef88 | out: puCount=0x53ef88*=0x0) returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetText (in: This=0xa22630, lFlags=2, puBuffLength=0x53ef84*=0x0, pszText=0x0 | out: puBuffLength=0x53ef84*=0x22, pszText=0x0) returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetText (in: This=0xa22630, lFlags=2, puBuffLength=0x53ef84*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x53ef84*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22630, puCount=0x53ef18 | out: puCount=0x53ef18*=0x0) returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ef04 | out: puCount=0x53ef04*=0x2) returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ef00*=0x0, pszText=0x0 | out: puBuffLength=0x53ef00*=0xf, pszText=0x0) returned 0x0
	[0164.317] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ef00*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef00*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0164.318] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x358
	[0164.318] SetEvent (hEvent=0x2c4) returned 1
	[0164.319] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53ee60*=0x358, lpdwindex=0x53ec84 | out: lpdwindex=0x53ec84) returned 0x0
	[0164.357] CoGetContextToken (in: pToken=0x53ed34 | out: pToken=0x53ed34) returned 0x0
	[0164.357] CoGetContextToken (in: pToken=0x53ec94 | out: pToken=0x53ec94) returned 0x0
	[0164.357] WbemDefPath:IUnknown:QueryInterface (in: This=0xa226a0, riid=0x53ed64*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53ed60 | out: ppvObject=0x53ed60*=0xa226a0) returned 0x0
	[0164.357] WbemDefPath:IUnknown:AddRef (This=0xa226a0) returned 0x3
	[0164.357] WbemDefPath:IUnknown:Release (This=0xa226a0) returned 0x2
	[0164.357] WbemDefPath:IWbemPath:SetText (This=0xa226a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0
	[0164.357] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53eedc | out: puCount=0x53eedc*=0x2) returned 0x0
	[0164.357] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53eed8*=0x0, pszText=0x0 | out: puBuffLength=0x53eed8*=0xf, pszText=0x0) returned 0x0
	[0164.357] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53eed8*=0xf, pszText="00000000000000" | out: puBuffLength=0x53eed8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0164.406] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53edfc*=0x36c, lpdwindex=0x53ecb4 | out: lpdwindex=0x53ecb4) returned 0x0
	[0164.645] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef00 | out: puCount=0x53ef00*=0x2) returned 0x0
	[0164.645] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53eefc*=0x0, pszText=0x0 | out: puBuffLength=0x53eefc*=0xf, pszText=0x0) returned 0x0
	[0164.646] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53eefc*=0xf, pszText="00000000000000" | out: puBuffLength=0x53eefc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0164.646] WbemDefPath:IWbemPath:GetText (in: This=0xa22630, lFlags=2, puBuffLength=0x53ef04*=0x0, pszText=0x0 | out: puBuffLength=0x53ef04*=0x22, pszText=0x0) returned 0x0
	[0164.646] WbemDefPath:IWbemPath:GetText (in: This=0xa22630, lFlags=2, puBuffLength=0x53ef04*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x53ef04*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0
	[0164.647] CoGetContextToken (in: pToken=0x53ec84 | out: pToken=0x53ec84) returned 0x0
	[0164.647] CoGetContextToken (in: pToken=0x53ebe4 | out: pToken=0x53ebe4) returned 0x0
	[0164.647] CoGetContextToken (in: pToken=0x53ebe4 | out: pToken=0x53ebe4) returned 0x0
	[0164.647] CoGetContextToken (in: pToken=0x53eb84 | out: pToken=0x53eb84) returned 0x0
	[0164.647] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x72588ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53eb5c | out: ppvObject=0x53eb5c*=0x9f1eb0) returned 0x0
	[0164.648] CObjectContext::ContextCallback () returned 0x0
	[0164.653] IUnknown:Release (This=0x9f1eb0) returned 0x1
	[0164.654] CoUnmarshalInterface (in: pStm=0xa2b470, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53ebd8 | out: ppv=0x53ebd8*=0xa5aca4) returned 0x0
	[0164.654] CoMarshalInterface (pStm=0xa2b470, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa5aca4, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
	[0164.654] WbemLocator:IUnknown:QueryInterface (in: This=0xa5aca4, riid=0x53ecb4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x53ecb0 | out: ppvObject=0x53ecb0*=0xa523f8) returned 0x0
	[0164.655] WbemLocator:IUnknown:Release (This=0xa5aca4) returned 0x1
	[0164.656] IWbemServices:GetObject (in: This=0xa523f8, strObjectPath="Win32_NetworkAdapterConfiguration", lFlags=0, pCtx=0x0, ppObject=0x53eeb8*=0x0, ppCallResult=0x0 | out: ppObject=0x53eeb8*=0xa73e18, ppCallResult=0x0) returned 0x0
	[0164.704] WbemLocator:IUnknown:Release (This=0xa523f8) returned 0x0
	[0164.705] IWbemClassObject:Get (in: This=0xa73e18, wszName="__PATH", lFlags=0, pVal=0x53eea0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53ef48*=0, plFlavor=0x53ef44*=0 | out: pVal=0x53eea0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x53ef48*=8, plFlavor=0x53ef44*=64) returned 0x0
	[0164.705] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x72
	[0164.705] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x72
	[0164.706] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x388
	[0164.706] SetEvent (hEvent=0x2c4) returned 1
	[0164.706] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53ee5c*=0x388, lpdwindex=0x53ec80 | out: lpdwindex=0x53ec80) returned 0x0
	[0164.712] CoGetContextToken (in: pToken=0x53ed34 | out: pToken=0x53ed34) returned 0x0
	[0164.712] CoGetContextToken (in: pToken=0x53ec94 | out: pToken=0x53ec94) returned 0x0
	[0164.712] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22710, riid=0x53ed64*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53ed60 | out: ppvObject=0x53ed60*=0xa22710) returned 0x0
	[0164.712] WbemDefPath:IUnknown:AddRef (This=0xa22710) returned 0x3
	[0164.712] WbemDefPath:IUnknown:Release (This=0xa22710) returned 0x2
	[0164.713] WbemDefPath:IWbemPath:SetText (This=0xa22710, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x0
	[0164.713] IWbemClassObject:Get (in: This=0xa73e18, wszName="__CLASS", lFlags=0, pVal=0x53ef10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53ef90*=0, plFlavor=0x53ef8c*=0 | out: pVal=0x53ef10*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x53ef90*=8, plFlavor=0x53ef8c*=64) returned 0x0
	[0164.713] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42
	[0164.713] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42
	[0164.713] CoGetContextToken (in: pToken=0x53ed0c | out: pToken=0x53ed0c) returned 0x0
	[0164.713] CoGetContextToken (in: pToken=0x53ec6c | out: pToken=0x53ec6c) returned 0x0
	[0164.713] CoGetContextToken (in: pToken=0x53ec6c | out: pToken=0x53ec6c) returned 0x0
	[0164.714] CoUnmarshalInterface (in: pStm=0xa2b470, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53ec60 | out: ppv=0x53ec60*=0xa5aca4) returned 0x0
	[0164.714] CoMarshalInterface (pStm=0xa2b470, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa5aca4, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
	[0164.715] WbemLocator:IUnknown:QueryInterface (in: This=0xa5aca4, riid=0x53ed3c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x53ed38 | out: ppvObject=0x53ed38*=0xa524e8) returned 0x0
	[0164.715] WbemLocator:IUnknown:Release (This=0xa5aca4) returned 0x1
	[0164.715] IWbemServices:CreateInstanceEnum (in: This=0xa524e8, strFilter="Win32_NetworkAdapterConfiguration", lFlags=17, pCtx=0x0, ppEnum=0x53ef0c | out: ppEnum=0x53ef0c*=0x9ef628) returned 0x0
	[0164.729] IUnknown:QueryInterface (in: This=0x9ef628, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ed74 | out: ppvObject=0x53ed74*=0x9ef62c) returned 0x0
	[0164.729] IClientSecurity:QueryBlanket (in: This=0x9ef62c, pProxy=0x9ef628, pAuthnSvc=0x53edc4, pAuthzSvc=0x53edc0, pServerPrincName=0x53edb8, pAuthnLevel=0x53edbc, pImpLevel=0x53edac, pAuthInfo=0x53edb0, pCapabilites=0x53edb4 | out: pAuthnSvc=0x53edc4*=0xa, pAuthzSvc=0x53edc0*=0x0, pServerPrincName=0x53edb8, pAuthnLevel=0x53edbc*=0x6, pImpLevel=0x53edac*=0x2, pAuthInfo=0x53edb0, pCapabilites=0x53edb4*=0x1) returned 0x0
	[0164.729] IUnknown:Release (This=0x9ef62c) returned 0x1
	[0164.729] IUnknown:QueryInterface (in: This=0x9ef628, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ed68 | out: ppvObject=0x53ed68*=0xa5ad94) returned 0x0
	[0164.729] IUnknown:QueryInterface (in: This=0x9ef628, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ed54 | out: ppvObject=0x53ed54*=0x9ef62c) returned 0x0
	[0164.730] IClientSecurity:SetBlanket (This=0x9ef62c, pProxy=0x9ef628, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0164.825] IUnknown:Release (This=0x9ef62c) returned 0x2
	[0164.825] WbemLocator:IUnknown:Release (This=0xa5ad94) returned 0x1
	[0164.825] CoTaskMemFree (pv=0xa53768) 
	[0164.826] IUnknown:AddRef (This=0x9ef628) returned 0x2
	[0164.826] CoGetContextToken (in: pToken=0x53e290 | out: pToken=0x53e290) returned 0x0
	[0164.826] CoGetContextToken (in: pToken=0x53e6a4 | out: pToken=0x53e6a4) returned 0x0
	[0164.827] IUnknown:QueryInterface (in: This=0x9ef628, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e63c | out: ppvObject=0x53e63c*=0xa5ad7c) returned 0x0
	[0164.827] WbemLocator:IRpcOptions:Query (in: This=0xa5ad7c, pPrx=0xa77808, dwProperty=2, pdwValue=0x53e730 | out: pdwValue=0x53e730) returned 0x80004002
	[0164.827] WbemLocator:IUnknown:Release (This=0xa5ad7c) returned 0x2
	[0164.827] CoGetContextToken (in: pToken=0x53ec74 | out: pToken=0x53ec74) returned 0x0
	[0164.827] CoGetContextToken (in: pToken=0x53ebd4 | out: pToken=0x53ebd4) returned 0x0
	[0164.828] IUnknown:QueryInterface (in: This=0x9ef628, riid=0x53eca4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x53eb70 | out: ppvObject=0x53eb70*=0x9ef628) returned 0x0
	[0164.828] IUnknown:Release (This=0x9ef628) returned 0x2
	[0164.828] WbemLocator:IUnknown:Release (This=0xa524e8) returned 0x0
	[0164.829] SysStringLen (param_1=0x0) returned 0x0
	[0164.829] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef48 | out: puCount=0x53ef48*=0x2) returned 0x0
	[0164.829] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef44*=0x0, pszText=0x0 | out: puBuffLength=0x53ef44*=0xf, pszText=0x0) returned 0x0
	[0164.830] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef44*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef44*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0164.830] CoGetContextToken (in: pToken=0x53ed94 | out: pToken=0x53ed94) returned 0x0
	[0164.830] IEnumWbemClassObject:Clone (in: This=0x9ef628, ppEnum=0x53ef48 | out: ppEnum=0x53ef48*=0x9ef6f0) returned 0x0
	[0164.872] IUnknown:QueryInterface (in: This=0x9ef6f0, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ee04 | out: ppvObject=0x53ee04*=0x9ef6f4) returned 0x0
	[0164.872] IClientSecurity:QueryBlanket (in: This=0x9ef6f4, pProxy=0x9ef6f0, pAuthnSvc=0x53ee54, pAuthzSvc=0x53ee50, pServerPrincName=0x53ee48, pAuthnLevel=0x53ee4c, pImpLevel=0x53ee3c, pAuthInfo=0x53ee40, pCapabilites=0x53ee44 | out: pAuthnSvc=0x53ee54*=0xa, pAuthzSvc=0x53ee50*=0x0, pServerPrincName=0x53ee48, pAuthnLevel=0x53ee4c*=0x6, pImpLevel=0x53ee3c*=0x2, pAuthInfo=0x53ee40, pCapabilites=0x53ee44*=0x1) returned 0x0
	[0164.872] IUnknown:Release (This=0x9ef6f4) returned 0x1
	[0164.872] IUnknown:QueryInterface (in: This=0x9ef6f0, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa5aca4) returned 0x0
	[0164.872] IUnknown:QueryInterface (in: This=0x9ef6f0, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53ede4 | out: ppvObject=0x53ede4*=0x9ef6f4) returned 0x0
	[0164.873] IClientSecurity:SetBlanket (This=0x9ef6f4, pProxy=0x9ef6f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0165.002] IUnknown:Release (This=0x9ef6f4) returned 0x2
	[0165.002] WbemLocator:IUnknown:Release (This=0xa5aca4) returned 0x1
	[0165.002] CoTaskMemFree (pv=0xa53678) 
	[0165.003] IUnknown:AddRef (This=0x9ef6f0) returned 0x2
	[0165.004] CoGetContextToken (in: pToken=0x53e314 | out: pToken=0x53e314) returned 0x0
	[0165.005] CoGetContextToken (in: pToken=0x53e724 | out: pToken=0x53e724) returned 0x0
	[0165.005] IUnknown:QueryInterface (in: This=0x9ef6f0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e6c0 | out: ppvObject=0x53e6c0*=0xa5ac8c) returned 0x0
	[0165.005] WbemLocator:IRpcOptions:Query (in: This=0xa5ac8c, pPrx=0xa77838, dwProperty=2, pdwValue=0x53e7b4 | out: pdwValue=0x53e7b4) returned 0x80004002
	[0165.005] WbemLocator:IUnknown:Release (This=0xa5ac8c) returned 0x2
	[0165.005] CoGetContextToken (in: pToken=0x53ecf4 | out: pToken=0x53ecf4) returned 0x0
	[0165.005] CoGetContextToken (in: pToken=0x53ec54 | out: pToken=0x53ec54) returned 0x0
	[0165.005] IUnknown:QueryInterface (in: This=0x9ef6f0, riid=0x53ed24*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x53ebf0 | out: ppvObject=0x53ebf0*=0x9ef6f0) returned 0x0
	[0165.006] IUnknown:Release (This=0x9ef6f0) returned 0x2
	[0165.006] SysStringLen (param_1=0x0) returned 0x0
	[0165.006] IEnumWbemClassObject:Reset (This=0x9ef6f0) returned 0x0
	[0165.104] CoTaskMemAlloc (cb=0x4) returned 0xa76c60
	[0165.104] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76c60, puReturned=0x22c61a8 | out: apObjects=0xa76c60*=0xa77ae8, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.182] IUnknown:QueryInterface (in: This=0xa77ae8, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa77ae8) returned 0x0
	[0165.183] IUnknown:QueryInterface (in: This=0xa77ae8, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.183] IUnknown:QueryInterface (in: This=0xa77ae8, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.183] IUnknown:AddRef (This=0xa77ae8) returned 0x3
	[0165.183] IUnknown:QueryInterface (in: This=0xa77ae8, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.184] IUnknown:QueryInterface (in: This=0xa77ae8, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.184] IUnknown:QueryInterface (in: This=0xa77ae8, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa77aec) returned 0x0
	[0165.184] IMarshal:GetUnmarshalClass (in: This=0xa77aec, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.184] IUnknown:Release (This=0xa77aec) returned 0x3
	[0165.184] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.184] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.184] IUnknown:QueryInterface (in: This=0xa77ae8, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.184] IUnknown:Release (This=0xa77ae8) returned 0x2
	[0165.185] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.185] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.185] IUnknown:QueryInterface (in: This=0xa77ae8, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa77ae8) returned 0x0
	[0165.185] IUnknown:AddRef (This=0xa77ae8) returned 0x4
	[0165.185] IUnknown:Release (This=0xa77ae8) returned 0x3
	[0165.185] IUnknown:Release (This=0xa77ae8) returned 0x2
	[0165.185] CoTaskMemFree (pv=0xa76c60) 
	[0165.186] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.186] IUnknown:AddRef (This=0xa77ae8) returned 0x3
	[0165.186] IWbemClassObject:Get (in: This=0xa77ae8, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.188] IWbemClassObject:Get (in: This=0xa77ae8, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.188] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x82
	[0165.189] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x82
	[0165.189] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x38c
	[0165.189] SetEvent (hEvent=0x2c4) returned 1
	[0165.189] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x38c, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.193] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.193] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.193] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22780, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa22780) returned 0x0
	[0165.194] WbemDefPath:IUnknown:AddRef (This=0xa22780) returned 0x3
	[0165.194] WbemDefPath:IUnknown:Release (This=0xa22780) returned 0x2
	[0165.194] WbemDefPath:IWbemPath:SetText (This=0xa22780, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x0
	[0165.194] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.194] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.194] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.199] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.199] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.199] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.200] IWbemClassObject:Get (in: This=0xa77ae8, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c6a84*=0, plFlavor=0x22c6a88*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c6a84*=11, plFlavor=0x22c6a88*=0) returned 0x0
	[0165.200] IWbemClassObject:Get (in: This=0xa77ae8, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c6a84*=11, plFlavor=0x22c6a88*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c6a84*=11, plFlavor=0x22c6a88*=0) returned 0x0
	[0165.217] IUnknown:Release (This=0xa77ae8) returned 0x2
	[0165.224] CoTaskMemAlloc (cb=0x4) returned 0xa76cb0
	[0165.224] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76cb0, puReturned=0x22c61a8 | out: apObjects=0xa76cb0*=0xa8cc08, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.232] IUnknown:QueryInterface (in: This=0xa8cc08, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa8cc08) returned 0x0
	[0165.233] IUnknown:QueryInterface (in: This=0xa8cc08, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.233] IUnknown:QueryInterface (in: This=0xa8cc08, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.234] IUnknown:AddRef (This=0xa8cc08) returned 0x3
	[0165.234] IUnknown:QueryInterface (in: This=0xa8cc08, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.234] IUnknown:QueryInterface (in: This=0xa8cc08, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.234] IUnknown:QueryInterface (in: This=0xa8cc08, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa8cc0c) returned 0x0
	[0165.234] IMarshal:GetUnmarshalClass (in: This=0xa8cc0c, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.234] IUnknown:Release (This=0xa8cc0c) returned 0x3
	[0165.234] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.234] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.234] IUnknown:QueryInterface (in: This=0xa8cc08, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.234] IUnknown:Release (This=0xa8cc08) returned 0x2
	[0165.234] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.234] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.234] IUnknown:QueryInterface (in: This=0xa8cc08, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa8cc08) returned 0x0
	[0165.235] IUnknown:AddRef (This=0xa8cc08) returned 0x4
	[0165.235] IUnknown:Release (This=0xa8cc08) returned 0x3
	[0165.235] IUnknown:Release (This=0xa8cc08) returned 0x2
	[0165.235] CoTaskMemFree (pv=0xa76cb0) 
	[0165.235] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.235] IUnknown:AddRef (This=0xa8cc08) returned 0x3
	[0165.235] IWbemClassObject:Get (in: This=0xa8cc08, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.236] IWbemClassObject:Get (in: This=0xa8cc08, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.236] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x82
	[0165.236] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x82
	[0165.236] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x390
	[0165.237] SetEvent (hEvent=0x2c4) returned 1
	[0165.237] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x390, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.240] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.241] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.241] WbemDefPath:IUnknown:QueryInterface (in: This=0xa227f0, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa227f0) returned 0x0
	[0165.241] WbemDefPath:IUnknown:AddRef (This=0xa227f0) returned 0x3
	[0165.241] WbemDefPath:IUnknown:Release (This=0xa227f0) returned 0x2
	[0165.241] WbemDefPath:IWbemPath:SetText (This=0xa227f0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x0
	[0165.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.241] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.241] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.241] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.241] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.241] IWbemClassObject:Get (in: This=0xa8cc08, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c7548*=0, plFlavor=0x22c754c*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c7548*=11, plFlavor=0x22c754c*=0) returned 0x0
	[0165.242] IWbemClassObject:Get (in: This=0xa8cc08, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c7548*=11, plFlavor=0x22c754c*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c7548*=11, plFlavor=0x22c754c*=0) returned 0x0
	[0165.242] IUnknown:Release (This=0xa8cc08) returned 0x2
	[0165.242] CoTaskMemAlloc (cb=0x4) returned 0xa76d00
	[0165.242] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76d00, puReturned=0x22c61a8 | out: apObjects=0xa76d00*=0xa8d3f0, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.257] IUnknown:QueryInterface (in: This=0xa8d3f0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa8d3f0) returned 0x0
	[0165.257] IUnknown:QueryInterface (in: This=0xa8d3f0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.257] IUnknown:QueryInterface (in: This=0xa8d3f0, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.257] IUnknown:AddRef (This=0xa8d3f0) returned 0x3
	[0165.257] IUnknown:QueryInterface (in: This=0xa8d3f0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.257] IUnknown:QueryInterface (in: This=0xa8d3f0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.257] IUnknown:QueryInterface (in: This=0xa8d3f0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa8d3f4) returned 0x0
	[0165.258] IMarshal:GetUnmarshalClass (in: This=0xa8d3f4, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.258] IUnknown:Release (This=0xa8d3f4) returned 0x3
	[0165.258] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.258] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.258] IUnknown:QueryInterface (in: This=0xa8d3f0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.258] IUnknown:Release (This=0xa8d3f0) returned 0x2
	[0165.258] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.258] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.258] IUnknown:QueryInterface (in: This=0xa8d3f0, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa8d3f0) returned 0x0
	[0165.258] IUnknown:AddRef (This=0xa8d3f0) returned 0x4
	[0165.258] IUnknown:Release (This=0xa8d3f0) returned 0x3
	[0165.258] IUnknown:Release (This=0xa8d3f0) returned 0x2
	[0165.258] CoTaskMemFree (pv=0xa76d00) 
	[0165.259] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.259] IUnknown:AddRef (This=0xa8d3f0) returned 0x3
	[0165.259] IWbemClassObject:Get (in: This=0xa8d3f0, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.259] IWbemClassObject:Get (in: This=0xa8d3f0, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.260] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x82
	[0165.260] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x82
	[0165.260] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x394
	[0165.260] SetEvent (hEvent=0x2c4) returned 1
	[0165.260] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x394, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.264] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.264] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.264] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22860, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa22860) returned 0x0
	[0165.264] WbemDefPath:IUnknown:AddRef (This=0xa22860) returned 0x3
	[0165.264] WbemDefPath:IUnknown:Release (This=0xa22860) returned 0x2
	[0165.264] WbemDefPath:IWbemPath:SetText (This=0xa22860, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x0
	[0165.264] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.264] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.264] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.264] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.264] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.264] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.264] IWbemClassObject:Get (in: This=0xa8d3f0, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c7dc4*=0, plFlavor=0x22c7dc8*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c7dc4*=11, plFlavor=0x22c7dc8*=0) returned 0x0
	[0165.265] IWbemClassObject:Get (in: This=0xa8d3f0, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c7dc4*=11, plFlavor=0x22c7dc8*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c7dc4*=11, plFlavor=0x22c7dc8*=0) returned 0x0
	[0165.265] IUnknown:Release (This=0xa8d3f0) returned 0x2
	[0165.265] CoTaskMemAlloc (cb=0x4) returned 0xa76d50
	[0165.265] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76d50, puReturned=0x22c61a8 | out: apObjects=0xa76d50*=0xa8d728, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.272] IUnknown:QueryInterface (in: This=0xa8d728, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa8d728) returned 0x0
	[0165.272] IUnknown:QueryInterface (in: This=0xa8d728, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.272] IUnknown:QueryInterface (in: This=0xa8d728, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.273] IUnknown:AddRef (This=0xa8d728) returned 0x3
	[0165.273] IUnknown:QueryInterface (in: This=0xa8d728, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.273] IUnknown:QueryInterface (in: This=0xa8d728, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.273] IUnknown:QueryInterface (in: This=0xa8d728, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa8d72c) returned 0x0
	[0165.273] IMarshal:GetUnmarshalClass (in: This=0xa8d72c, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.273] IUnknown:Release (This=0xa8d72c) returned 0x3
	[0165.273] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.273] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.273] IUnknown:QueryInterface (in: This=0xa8d728, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.273] IUnknown:Release (This=0xa8d728) returned 0x2
	[0165.273] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.273] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.273] IUnknown:QueryInterface (in: This=0xa8d728, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa8d728) returned 0x0
	[0165.274] IUnknown:AddRef (This=0xa8d728) returned 0x4
	[0165.274] IUnknown:Release (This=0xa8d728) returned 0x3
	[0165.274] IUnknown:Release (This=0xa8d728) returned 0x2
	[0165.274] CoTaskMemFree (pv=0xa76d50) 
	[0165.274] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.274] IUnknown:AddRef (This=0xa8d728) returned 0x3
	[0165.274] IWbemClassObject:Get (in: This=0xa8d728, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.274] IWbemClassObject:Get (in: This=0xa8d728, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.275] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x82
	[0165.275] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x82
	[0165.275] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x398
	[0165.275] SetEvent (hEvent=0x2c4) returned 1
	[0165.275] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x398, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.279] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.279] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.279] WbemDefPath:IUnknown:QueryInterface (in: This=0xa228d0, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa228d0) returned 0x0
	[0165.280] WbemDefPath:IUnknown:AddRef (This=0xa228d0) returned 0x3
	[0165.280] WbemDefPath:IUnknown:Release (This=0xa228d0) returned 0x2
	[0165.280] WbemDefPath:IWbemPath:SetText (This=0xa228d0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x0
	[0165.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.280] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.280] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.280] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.280] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.280] IWbemClassObject:Get (in: This=0xa8d728, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c864c*=0, plFlavor=0x22c8650*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c864c*=11, plFlavor=0x22c8650*=0) returned 0x0
	[0165.280] IWbemClassObject:Get (in: This=0xa8d728, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c864c*=11, plFlavor=0x22c8650*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c864c*=11, plFlavor=0x22c8650*=0) returned 0x0
	[0165.281] IUnknown:Release (This=0xa8d728) returned 0x2
	[0165.281] CoTaskMemAlloc (cb=0x4) returned 0xa76da0
	[0165.281] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76da0, puReturned=0x22c61a8 | out: apObjects=0xa76da0*=0xa8da60, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.292] IUnknown:QueryInterface (in: This=0xa8da60, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa8da60) returned 0x0
	[0165.292] IUnknown:QueryInterface (in: This=0xa8da60, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.292] IUnknown:QueryInterface (in: This=0xa8da60, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.293] IUnknown:AddRef (This=0xa8da60) returned 0x3
	[0165.293] IUnknown:QueryInterface (in: This=0xa8da60, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.293] IUnknown:QueryInterface (in: This=0xa8da60, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.293] IUnknown:QueryInterface (in: This=0xa8da60, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa8da64) returned 0x0
	[0165.293] IMarshal:GetUnmarshalClass (in: This=0xa8da64, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.293] IUnknown:Release (This=0xa8da64) returned 0x3
	[0165.293] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.293] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.293] IUnknown:QueryInterface (in: This=0xa8da60, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.293] IUnknown:Release (This=0xa8da60) returned 0x2
	[0165.293] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.294] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.294] IUnknown:QueryInterface (in: This=0xa8da60, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa8da60) returned 0x0
	[0165.294] IUnknown:AddRef (This=0xa8da60) returned 0x4
	[0165.294] IUnknown:Release (This=0xa8da60) returned 0x3
	[0165.294] IUnknown:Release (This=0xa8da60) returned 0x2
	[0165.294] CoTaskMemFree (pv=0xa76da0) 
	[0165.294] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.294] IUnknown:AddRef (This=0xa8da60) returned 0x3
	[0165.294] IWbemClassObject:Get (in: This=0xa8da60, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.295] IWbemClassObject:Get (in: This=0xa8da60, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.295] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x82
	[0165.295] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x82
	[0165.296] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x39c
	[0165.296] SetEvent (hEvent=0x2c4) returned 1
	[0165.296] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x39c, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.316] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.316] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.316] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8ddb0, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa8ddb0) returned 0x0
	[0165.316] WbemDefPath:IUnknown:AddRef (This=0xa8ddb0) returned 0x3
	[0165.316] WbemDefPath:IUnknown:Release (This=0xa8ddb0) returned 0x2
	[0165.316] WbemDefPath:IWbemPath:SetText (This=0xa8ddb0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x0
	[0165.316] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.316] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.316] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.316] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.316] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.316] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.316] IWbemClassObject:Get (in: This=0xa8da60, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c8ec8*=0, plFlavor=0x22c8ecc*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c8ec8*=11, plFlavor=0x22c8ecc*=0) returned 0x0
	[0165.317] IWbemClassObject:Get (in: This=0xa8da60, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c8ec8*=11, plFlavor=0x22c8ecc*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c8ec8*=11, plFlavor=0x22c8ecc*=0) returned 0x0
	[0165.317] IUnknown:Release (This=0xa8da60) returned 0x2
	[0165.317] CoTaskMemAlloc (cb=0x4) returned 0xa76df0
	[0165.317] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76df0, puReturned=0x22c61a8 | out: apObjects=0xa76df0*=0xa8ed98, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.329] IUnknown:QueryInterface (in: This=0xa8ed98, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa8ed98) returned 0x0
	[0165.329] IUnknown:QueryInterface (in: This=0xa8ed98, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.329] IUnknown:QueryInterface (in: This=0xa8ed98, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.330] IUnknown:AddRef (This=0xa8ed98) returned 0x3
	[0165.330] IUnknown:QueryInterface (in: This=0xa8ed98, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.330] IUnknown:QueryInterface (in: This=0xa8ed98, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.330] IUnknown:QueryInterface (in: This=0xa8ed98, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa8ed9c) returned 0x0
	[0165.330] IMarshal:GetUnmarshalClass (in: This=0xa8ed9c, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.330] IUnknown:Release (This=0xa8ed9c) returned 0x3
	[0165.330] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.331] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.331] IUnknown:QueryInterface (in: This=0xa8ed98, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.331] IUnknown:Release (This=0xa8ed98) returned 0x2
	[0165.331] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.331] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.331] IUnknown:QueryInterface (in: This=0xa8ed98, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa8ed98) returned 0x0
	[0165.331] IUnknown:AddRef (This=0xa8ed98) returned 0x4
	[0165.331] IUnknown:Release (This=0xa8ed98) returned 0x3
	[0165.331] IUnknown:Release (This=0xa8ed98) returned 0x2
	[0165.331] CoTaskMemFree (pv=0xa76df0) 
	[0165.332] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.332] IUnknown:AddRef (This=0xa8ed98) returned 0x3
	[0165.332] IWbemClassObject:Get (in: This=0xa8ed98, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.333] IWbemClassObject:Get (in: This=0xa8ed98, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.333] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x82
	[0165.333] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x82
	[0165.334] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a0
	[0165.334] SetEvent (hEvent=0x2c4) returned 1
	[0165.334] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x3a0, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.339] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.339] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.339] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de20, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa8de20) returned 0x0
	[0165.340] WbemDefPath:IUnknown:AddRef (This=0xa8de20) returned 0x3
	[0165.340] WbemDefPath:IUnknown:Release (This=0xa8de20) returned 0x2
	[0165.340] WbemDefPath:IWbemPath:SetText (This=0xa8de20, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x0
	[0165.340] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.340] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.340] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.340] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.340] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.340] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.340] IWbemClassObject:Get (in: This=0xa8ed98, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c9744*=0, plFlavor=0x22c9748*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c9744*=11, plFlavor=0x22c9748*=0) returned 0x0
	[0165.341] IWbemClassObject:Get (in: This=0xa8ed98, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c9744*=11, plFlavor=0x22c9748*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c9744*=11, plFlavor=0x22c9748*=0) returned 0x0
	[0165.341] IUnknown:Release (This=0xa8ed98) returned 0x2
	[0165.342] CoTaskMemAlloc (cb=0x4) returned 0xa76e40
	[0165.342] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76e40, puReturned=0x22c61a8 | out: apObjects=0xa76e40*=0xa8c960, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.363] IUnknown:QueryInterface (in: This=0xa8c960, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa8c960) returned 0x0
	[0165.364] IUnknown:QueryInterface (in: This=0xa8c960, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.364] IUnknown:QueryInterface (in: This=0xa8c960, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.364] IUnknown:AddRef (This=0xa8c960) returned 0x3
	[0165.364] IUnknown:QueryInterface (in: This=0xa8c960, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.364] IUnknown:QueryInterface (in: This=0xa8c960, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.364] IUnknown:QueryInterface (in: This=0xa8c960, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa8c964) returned 0x0
	[0165.364] IMarshal:GetUnmarshalClass (in: This=0xa8c964, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.365] IUnknown:Release (This=0xa8c964) returned 0x3
	[0165.365] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.365] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.365] IUnknown:QueryInterface (in: This=0xa8c960, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.365] IUnknown:Release (This=0xa8c960) returned 0x2
	[0165.365] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.365] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.365] IUnknown:QueryInterface (in: This=0xa8c960, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa8c960) returned 0x0
	[0165.365] IUnknown:AddRef (This=0xa8c960) returned 0x4
	[0165.365] IUnknown:Release (This=0xa8c960) returned 0x3
	[0165.365] IUnknown:Release (This=0xa8c960) returned 0x2
	[0165.365] CoTaskMemFree (pv=0xa76e40) 
	[0165.366] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.366] IUnknown:AddRef (This=0xa8c960) returned 0x3
	[0165.366] IWbemClassObject:Get (in: This=0xa8c960, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.366] IWbemClassObject:Get (in: This=0xa8c960, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=6", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.366] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=6") returned 0x82
	[0165.366] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=6") returned 0x82
	[0165.367] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a4
	[0165.367] SetEvent (hEvent=0x2c4) returned 1
	[0165.367] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x3a4, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.371] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.371] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.371] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de90, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa8de90) returned 0x0
	[0165.371] WbemDefPath:IUnknown:AddRef (This=0xa8de90) returned 0x3
	[0165.371] WbemDefPath:IUnknown:Release (This=0xa8de90) returned 0x2
	[0165.371] WbemDefPath:IWbemPath:SetText (This=0xa8de90, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=6") returned 0x0
	[0165.371] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.371] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.371] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.371] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.371] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.371] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.371] IWbemClassObject:Get (in: This=0xa8c960, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c9fc0*=0, plFlavor=0x22c9fc4*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c9fc0*=11, plFlavor=0x22c9fc4*=0) returned 0x0
	[0165.372] IWbemClassObject:Get (in: This=0xa8c960, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c9fc0*=11, plFlavor=0x22c9fc4*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c9fc0*=11, plFlavor=0x22c9fc4*=0) returned 0x0
	[0165.373] IUnknown:Release (This=0xa8c960) returned 0x2
	[0165.373] CoTaskMemAlloc (cb=0x4) returned 0xa76e90
	[0165.373] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76e90, puReturned=0x22c61a8 | out: apObjects=0xa76e90*=0xa8ffd0, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.381] IUnknown:QueryInterface (in: This=0xa8ffd0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa8ffd0) returned 0x0
	[0165.382] IUnknown:QueryInterface (in: This=0xa8ffd0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.382] IUnknown:QueryInterface (in: This=0xa8ffd0, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.382] IUnknown:AddRef (This=0xa8ffd0) returned 0x3
	[0165.382] IUnknown:QueryInterface (in: This=0xa8ffd0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.382] IUnknown:QueryInterface (in: This=0xa8ffd0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.382] IUnknown:QueryInterface (in: This=0xa8ffd0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa8ffd4) returned 0x0
	[0165.383] IMarshal:GetUnmarshalClass (in: This=0xa8ffd4, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.383] IUnknown:Release (This=0xa8ffd4) returned 0x3
	[0165.383] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.383] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.383] IUnknown:QueryInterface (in: This=0xa8ffd0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.383] IUnknown:Release (This=0xa8ffd0) returned 0x2
	[0165.383] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.383] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.383] IUnknown:QueryInterface (in: This=0xa8ffd0, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa8ffd0) returned 0x0
	[0165.383] IUnknown:AddRef (This=0xa8ffd0) returned 0x4
	[0165.384] IUnknown:Release (This=0xa8ffd0) returned 0x3
	[0165.384] IUnknown:Release (This=0xa8ffd0) returned 0x2
	[0165.384] CoTaskMemFree (pv=0xa76e90) 
	[0165.384] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.384] IUnknown:AddRef (This=0xa8ffd0) returned 0x3
	[0165.384] IWbemClassObject:Get (in: This=0xa8ffd0, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.385] IWbemClassObject:Get (in: This=0xa8ffd0, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=7", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.385] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=7") returned 0x82
	[0165.386] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=7") returned 0x82
	[0165.386] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a8
	[0165.386] SetEvent (hEvent=0x2c4) returned 1
	[0165.386] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x3a8, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.391] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.391] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.391] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df00, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa8df00) returned 0x0
	[0165.391] WbemDefPath:IUnknown:AddRef (This=0xa8df00) returned 0x3
	[0165.391] WbemDefPath:IUnknown:Release (This=0xa8df00) returned 0x2
	[0165.391] WbemDefPath:IWbemPath:SetText (This=0xa8df00, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=7") returned 0x0
	[0165.392] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.392] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.392] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.392] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.392] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.392] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.392] IWbemClassObject:Get (in: This=0xa8ffd0, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ca848*=0, plFlavor=0x22ca84c*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ca848*=11, plFlavor=0x22ca84c*=0) returned 0x0
	[0165.392] IWbemClassObject:Get (in: This=0xa8ffd0, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ca848*=11, plFlavor=0x22ca84c*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ca848*=11, plFlavor=0x22ca84c*=0) returned 0x0
	[0165.393] IUnknown:Release (This=0xa8ffd0) returned 0x2
	[0165.393] CoTaskMemAlloc (cb=0x4) returned 0xa76ee0
	[0165.393] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76ee0, puReturned=0x22c61a8 | out: apObjects=0xa76ee0*=0xa55690, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.412] IUnknown:QueryInterface (in: This=0xa55690, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa55690) returned 0x0
	[0165.413] IUnknown:QueryInterface (in: This=0xa55690, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.413] IUnknown:QueryInterface (in: This=0xa55690, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.413] IUnknown:AddRef (This=0xa55690) returned 0x3
	[0165.413] IUnknown:QueryInterface (in: This=0xa55690, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.413] IUnknown:QueryInterface (in: This=0xa55690, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.413] IUnknown:QueryInterface (in: This=0xa55690, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa55694) returned 0x0
	[0165.414] IMarshal:GetUnmarshalClass (in: This=0xa55694, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.414] IUnknown:Release (This=0xa55694) returned 0x3
	[0165.414] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.414] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.414] IUnknown:QueryInterface (in: This=0xa55690, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.414] IUnknown:Release (This=0xa55690) returned 0x2
	[0165.414] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.414] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.414] IUnknown:QueryInterface (in: This=0xa55690, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa55690) returned 0x0
	[0165.414] IUnknown:AddRef (This=0xa55690) returned 0x4
	[0165.414] IUnknown:Release (This=0xa55690) returned 0x3
	[0165.414] IUnknown:Release (This=0xa55690) returned 0x2
	[0165.414] CoTaskMemFree (pv=0xa76ee0) 
	[0165.415] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.415] IUnknown:AddRef (This=0xa55690) returned 0x3
	[0165.415] IWbemClassObject:Get (in: This=0xa55690, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.416] IWbemClassObject:Get (in: This=0xa55690, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=8", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.416] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=8") returned 0x82
	[0165.416] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=8") returned 0x82
	[0165.416] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3ac
	[0165.416] SetEvent (hEvent=0x2c4) returned 1
	[0165.416] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x3ac, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.421] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.421] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.421] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df70, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa8df70) returned 0x0
	[0165.421] WbemDefPath:IUnknown:AddRef (This=0xa8df70) returned 0x3
	[0165.421] WbemDefPath:IUnknown:Release (This=0xa8df70) returned 0x2
	[0165.421] WbemDefPath:IWbemPath:SetText (This=0xa8df70, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=8") returned 0x0
	[0165.422] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.422] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.422] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.422] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.422] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.422] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.422] IWbemClassObject:Get (in: This=0xa55690, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb0c4*=0, plFlavor=0x22cb0c8*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb0c4*=11, plFlavor=0x22cb0c8*=0) returned 0x0
	[0165.423] IWbemClassObject:Get (in: This=0xa55690, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb0c4*=11, plFlavor=0x22cb0c8*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb0c4*=11, plFlavor=0x22cb0c8*=0) returned 0x0
	[0165.423] IUnknown:Release (This=0xa55690) returned 0x2
	[0165.423] CoTaskMemAlloc (cb=0x4) returned 0xa76f30
	[0165.423] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76f30, puReturned=0x22c61a8 | out: apObjects=0xa76f30*=0xa55490, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.441] IUnknown:QueryInterface (in: This=0xa55490, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa55490) returned 0x0
	[0165.442] IUnknown:QueryInterface (in: This=0xa55490, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.442] IUnknown:QueryInterface (in: This=0xa55490, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.442] IUnknown:AddRef (This=0xa55490) returned 0x3
	[0165.442] IUnknown:QueryInterface (in: This=0xa55490, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.442] IUnknown:QueryInterface (in: This=0xa55490, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.442] IUnknown:QueryInterface (in: This=0xa55490, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa55494) returned 0x0
	[0165.442] IMarshal:GetUnmarshalClass (in: This=0xa55494, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.442] IUnknown:Release (This=0xa55494) returned 0x3
	[0165.442] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.443] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.443] IUnknown:QueryInterface (in: This=0xa55490, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.443] IUnknown:Release (This=0xa55490) returned 0x2
	[0165.443] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.443] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.443] IUnknown:QueryInterface (in: This=0xa55490, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa55490) returned 0x0
	[0165.443] IUnknown:AddRef (This=0xa55490) returned 0x4
	[0165.443] IUnknown:Release (This=0xa55490) returned 0x3
	[0165.443] IUnknown:Release (This=0xa55490) returned 0x2
	[0165.443] CoTaskMemFree (pv=0xa76f30) 
	[0165.443] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.443] IUnknown:AddRef (This=0xa55490) returned 0x3
	[0165.444] IWbemClassObject:Get (in: This=0xa55490, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.444] IWbemClassObject:Get (in: This=0xa55490, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=9", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.444] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=9") returned 0x82
	[0165.444] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=9") returned 0x82
	[0165.444] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b0
	[0165.445] SetEvent (hEvent=0x2c4) returned 1
	[0165.445] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x3b0, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.449] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.449] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.449] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8dfe0, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa8dfe0) returned 0x0
	[0165.449] WbemDefPath:IUnknown:AddRef (This=0xa8dfe0) returned 0x3
	[0165.449] WbemDefPath:IUnknown:Release (This=0xa8dfe0) returned 0x2
	[0165.449] WbemDefPath:IWbemPath:SetText (This=0xa8dfe0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=9") returned 0x0
	[0165.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.449] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.449] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.449] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.449] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.450] IWbemClassObject:Get (in: This=0xa55490, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb940*=0, plFlavor=0x22cb944*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb940*=11, plFlavor=0x22cb944*=0) returned 0x0
	[0165.450] IWbemClassObject:Get (in: This=0xa55490, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb940*=11, plFlavor=0x22cb944*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb940*=11, plFlavor=0x22cb944*=0) returned 0x0
	[0165.450] IUnknown:Release (This=0xa55490) returned 0x2
	[0165.450] CoTaskMemAlloc (cb=0x4) returned 0xa76f80
	[0165.450] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa76f80, puReturned=0x22c61a8 | out: apObjects=0xa76f80*=0xa91e78, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.454] IUnknown:QueryInterface (in: This=0xa91e78, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa91e78) returned 0x0
	[0165.454] IUnknown:QueryInterface (in: This=0xa91e78, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.454] IUnknown:QueryInterface (in: This=0xa91e78, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.454] IUnknown:AddRef (This=0xa91e78) returned 0x3
	[0165.454] IUnknown:QueryInterface (in: This=0xa91e78, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.454] IUnknown:QueryInterface (in: This=0xa91e78, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.455] IUnknown:QueryInterface (in: This=0xa91e78, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa91e7c) returned 0x0
	[0165.455] IMarshal:GetUnmarshalClass (in: This=0xa91e7c, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.455] IUnknown:Release (This=0xa91e7c) returned 0x3
	[0165.455] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.455] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.455] IUnknown:QueryInterface (in: This=0xa91e78, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.455] IUnknown:Release (This=0xa91e78) returned 0x2
	[0165.455] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.455] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.455] IUnknown:QueryInterface (in: This=0xa91e78, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa91e78) returned 0x0
	[0165.456] IUnknown:AddRef (This=0xa91e78) returned 0x4
	[0165.456] IUnknown:Release (This=0xa91e78) returned 0x3
	[0165.456] IUnknown:Release (This=0xa91e78) returned 0x2
	[0165.456] CoTaskMemFree (pv=0xa76f80) 
	[0165.456] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.456] IUnknown:AddRef (This=0xa91e78) returned 0x3
	[0165.456] IWbemClassObject:Get (in: This=0xa91e78, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.457] IWbemClassObject:Get (in: This=0xa91e78, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=10", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.457] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=10") returned 0x84
	[0165.457] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=10") returned 0x84
	[0165.457] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b4
	[0165.457] SetEvent (hEvent=0x2c4) returned 1
	[0165.458] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x3b4, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.461] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.461] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.461] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e050, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa8e050) returned 0x0
	[0165.461] WbemDefPath:IUnknown:AddRef (This=0xa8e050) returned 0x3
	[0165.461] WbemDefPath:IUnknown:Release (This=0xa8e050) returned 0x2
	[0165.461] WbemDefPath:IWbemPath:SetText (This=0xa8e050, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=10") returned 0x0
	[0165.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.462] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.462] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.462] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.462] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.462] IWbemClassObject:Get (in: This=0xa91e78, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc1cc*=0, plFlavor=0x22cc1d0*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc1cc*=11, plFlavor=0x22cc1d0*=0) returned 0x0
	[0165.463] IWbemClassObject:Get (in: This=0xa91e78, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc1cc*=11, plFlavor=0x22cc1d0*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc1cc*=11, plFlavor=0x22cc1d0*=0) returned 0x0
	[0165.463] IUnknown:Release (This=0xa91e78) returned 0x2
	[0165.463] CoTaskMemAlloc (cb=0x4) returned 0xa91ad0
	[0165.463] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa91ad0, puReturned=0x22c61a8 | out: apObjects=0xa91ad0*=0xa90578, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.465] IUnknown:QueryInterface (in: This=0xa90578, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa90578) returned 0x0
	[0165.465] IUnknown:QueryInterface (in: This=0xa90578, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.465] IUnknown:QueryInterface (in: This=0xa90578, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.466] IUnknown:AddRef (This=0xa90578) returned 0x3
	[0165.466] IUnknown:QueryInterface (in: This=0xa90578, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.466] IUnknown:QueryInterface (in: This=0xa90578, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.466] IUnknown:QueryInterface (in: This=0xa90578, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa9057c) returned 0x0
	[0165.466] IMarshal:GetUnmarshalClass (in: This=0xa9057c, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.466] IUnknown:Release (This=0xa9057c) returned 0x3
	[0165.466] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.466] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.466] IUnknown:QueryInterface (in: This=0xa90578, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.466] IUnknown:Release (This=0xa90578) returned 0x2
	[0165.466] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.466] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.467] IUnknown:QueryInterface (in: This=0xa90578, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa90578) returned 0x0
	[0165.467] IUnknown:AddRef (This=0xa90578) returned 0x4
	[0165.467] IUnknown:Release (This=0xa90578) returned 0x3
	[0165.467] IUnknown:Release (This=0xa90578) returned 0x2
	[0165.467] CoTaskMemFree (pv=0xa91ad0) 
	[0165.467] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.467] IUnknown:AddRef (This=0xa90578) returned 0x3
	[0165.467] IWbemClassObject:Get (in: This=0xa90578, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.468] IWbemClassObject:Get (in: This=0xa90578, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=11", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.468] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=11") returned 0x84
	[0165.468] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=11") returned 0x84
	[0165.468] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b8
	[0165.468] SetEvent (hEvent=0x2c4) returned 1
	[0165.469] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x3b8, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.473] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.473] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.473] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e0c0, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa8e0c0) returned 0x0
	[0165.473] WbemDefPath:IUnknown:AddRef (This=0xa8e0c0) returned 0x3
	[0165.473] WbemDefPath:IUnknown:Release (This=0xa8e0c0) returned 0x2
	[0165.473] WbemDefPath:IWbemPath:SetText (This=0xa8e0c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=11") returned 0x0
	[0165.474] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.474] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.474] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.474] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.474] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.474] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.474] IWbemClassObject:Get (in: This=0xa90578, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cca4c*=0, plFlavor=0x22cca50*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cca4c*=11, plFlavor=0x22cca50*=0) returned 0x0
	[0165.475] IWbemClassObject:Get (in: This=0xa90578, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cca4c*=11, plFlavor=0x22cca50*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cca4c*=11, plFlavor=0x22cca50*=0) returned 0x0
	[0165.475] IUnknown:Release (This=0xa90578) returned 0x2
	[0165.475] CoTaskMemAlloc (cb=0x4) returned 0xa91b20
	[0165.475] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa91b20, puReturned=0x22c61a8 | out: apObjects=0xa91b20*=0xa978b8, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.477] IUnknown:QueryInterface (in: This=0xa978b8, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa978b8) returned 0x0
	[0165.477] IUnknown:QueryInterface (in: This=0xa978b8, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.477] IUnknown:QueryInterface (in: This=0xa978b8, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.477] IUnknown:AddRef (This=0xa978b8) returned 0x3
	[0165.477] IUnknown:QueryInterface (in: This=0xa978b8, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.477] IUnknown:QueryInterface (in: This=0xa978b8, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.477] IUnknown:QueryInterface (in: This=0xa978b8, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa978bc) returned 0x0
	[0165.478] IMarshal:GetUnmarshalClass (in: This=0xa978bc, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.478] IUnknown:Release (This=0xa978bc) returned 0x3
	[0165.478] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.478] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.478] IUnknown:QueryInterface (in: This=0xa978b8, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.478] IUnknown:Release (This=0xa978b8) returned 0x2
	[0165.478] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.478] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.478] IUnknown:QueryInterface (in: This=0xa978b8, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa978b8) returned 0x0
	[0165.478] IUnknown:AddRef (This=0xa978b8) returned 0x4
	[0165.478] IUnknown:Release (This=0xa978b8) returned 0x3
	[0165.478] IUnknown:Release (This=0xa978b8) returned 0x2
	[0165.478] CoTaskMemFree (pv=0xa91b20) 
	[0165.479] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.479] IUnknown:AddRef (This=0xa978b8) returned 0x3
	[0165.479] IWbemClassObject:Get (in: This=0xa978b8, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.479] IWbemClassObject:Get (in: This=0xa978b8, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=12", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.479] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=12") returned 0x84
	[0165.479] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=12") returned 0x84
	[0165.480] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3bc
	[0165.480] SetEvent (hEvent=0x2c4) returned 1
	[0165.480] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x3bc, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.484] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.484] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.484] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e130, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa8e130) returned 0x0
	[0165.484] WbemDefPath:IUnknown:AddRef (This=0xa8e130) returned 0x3
	[0165.484] WbemDefPath:IUnknown:Release (This=0xa8e130) returned 0x2
	[0165.484] WbemDefPath:IWbemPath:SetText (This=0xa8e130, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=12") returned 0x0
	[0165.484] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.484] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.485] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.485] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.485] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.485] IWbemClassObject:Get (in: This=0xa978b8, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd2cc*=0, plFlavor=0x22cd2d0*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd2cc*=11, plFlavor=0x22cd2d0*=0) returned 0x0
	[0165.485] IWbemClassObject:Get (in: This=0xa978b8, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd2cc*=11, plFlavor=0x22cd2d0*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd2cc*=11, plFlavor=0x22cd2d0*=0) returned 0x0
	[0165.486] IUnknown:Release (This=0xa978b8) returned 0x2
	[0165.486] CoTaskMemAlloc (cb=0x4) returned 0xa91b70
	[0165.486] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa91b70, puReturned=0x22c61a8 | out: apObjects=0xa91b70*=0xa97a50, puReturned=0x22c61a8*=0x1) returned 0x0
	[0165.487] IUnknown:QueryInterface (in: This=0xa97a50, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e59c | out: ppvObject=0x53e59c*=0xa97a50) returned 0x0
	[0165.488] IUnknown:QueryInterface (in: This=0xa97a50, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e550 | out: ppvObject=0x53e550*=0x0) returned 0x80004002
	[0165.488] IUnknown:QueryInterface (in: This=0xa97a50, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e378 | out: ppvObject=0x53e378*=0x0) returned 0x80004002
	[0165.488] IUnknown:AddRef (This=0xa97a50) returned 0x3
	[0165.488] IUnknown:QueryInterface (in: This=0xa97a50, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53deac | out: ppvObject=0x53deac*=0x0) returned 0x80004002
	[0165.488] IUnknown:QueryInterface (in: This=0xa97a50, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0165.488] IUnknown:QueryInterface (in: This=0xa97a50, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0xa97a54) returned 0x0
	[0165.488] IMarshal:GetUnmarshalClass (in: This=0xa97a54, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53de70 | out: pCid=0x53de70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0165.488] IUnknown:Release (This=0xa97a54) returned 0x3
	[0165.488] CoGetContextToken (in: pToken=0x53dec8 | out: pToken=0x53dec8) returned 0x0
	[0165.488] CoGetContextToken (in: pToken=0x53e2dc | out: pToken=0x53e2dc) returned 0x0
	[0165.489] IUnknown:QueryInterface (in: This=0xa97a50, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e35c | out: ppvObject=0x53e35c*=0x0) returned 0x80004002
	[0165.489] IUnknown:Release (This=0xa97a50) returned 0x2
	[0165.489] CoGetContextToken (in: pToken=0x53e8cc | out: pToken=0x53e8cc) returned 0x0
	[0165.489] CoGetContextToken (in: pToken=0x53e82c | out: pToken=0x53e82c) returned 0x0
	[0165.489] IUnknown:QueryInterface (in: This=0xa97a50, riid=0x53e8fc*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e8f8 | out: ppvObject=0x53e8f8*=0xa97a50) returned 0x0
	[0165.489] IUnknown:AddRef (This=0xa97a50) returned 0x4
	[0165.489] IUnknown:Release (This=0xa97a50) returned 0x3
	[0165.489] IUnknown:Release (This=0xa97a50) returned 0x2
	[0165.489] CoTaskMemFree (pv=0xa91b70) 
	[0165.489] CoGetContextToken (in: pToken=0x53ec3c | out: pToken=0x53ec3c) returned 0x0
	[0165.489] IUnknown:AddRef (This=0xa97a50) returned 0x3
	[0165.489] IWbemClassObject:Get (in: This=0xa97a50, wszName="__GENUS", lFlags=0, pVal=0x53ef38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efb8*=0, plFlavor=0x53efb4*=0 | out: pVal=0x53ef38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53efb8*=3, plFlavor=0x53efb4*=64) returned 0x0
	[0165.490] IWbemClassObject:Get (in: This=0xa97a50, wszName="__PATH", lFlags=0, pVal=0x53ef1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53efa0*=0, plFlavor=0x53ef9c*=0 | out: pVal=0x53ef1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=13", varVal2=0x0), pType=0x53efa0*=8, plFlavor=0x53ef9c*=64) returned 0x0
	[0165.490] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=13") returned 0x84
	[0165.491] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=13") returned 0x84
	[0165.491] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c0
	[0165.491] SetEvent (hEvent=0x2c4) returned 1
	[0165.491] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53eef4*=0x3c0, lpdwindex=0x53ed18 | out: lpdwindex=0x53ed18) returned 0x0
	[0165.495] CoGetContextToken (in: pToken=0x53edcc | out: pToken=0x53edcc) returned 0x0
	[0165.495] CoGetContextToken (in: pToken=0x53ed2c | out: pToken=0x53ed2c) returned 0x0
	[0165.495] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e1a0, riid=0x53edfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53edf8 | out: ppvObject=0x53edf8*=0xa8e1a0) returned 0x0
	[0165.495] WbemDefPath:IUnknown:AddRef (This=0xa8e1a0) returned 0x3
	[0165.495] WbemDefPath:IUnknown:Release (This=0xa8e1a0) returned 0x2
	[0165.495] WbemDefPath:IWbemPath:SetText (This=0xa8e1a0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=13") returned 0x0
	[0165.495] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef74 | out: puCount=0x53ef74*=0x2) returned 0x0
	[0165.495] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0x0, pszText=0x0 | out: puBuffLength=0x53ef70*=0xf, pszText=0x0) returned 0x0
	[0165.495] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef70*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.495] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.495] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.495] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.495] IWbemClassObject:Get (in: This=0xa97a50, wszName="IPEnabled", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cdb4c*=0, plFlavor=0x22cdb50*=0 | out: pVal=0x53ef3c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x22cdb4c*=11, plFlavor=0x22cdb50*=0) returned 0x0
	[0165.496] IWbemClassObject:Get (in: This=0xa97a50, wszName="IPEnabled", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cdb4c*=11, plFlavor=0x22cdb50*=0 | out: pVal=0x53ef44*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x22cdb4c*=11, plFlavor=0x22cdb50*=0) returned 0x0
	[0165.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x53ef40 | out: puCount=0x53ef40*=0x2) returned 0x0
	[0165.504] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ef3c*=0xf, pszText=0x0) returned 0x0
	[0165.504] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=4, puBuffLength=0x53ef3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ef3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0165.504] IWbemClassObject:Get (in: This=0xa97a50, wszName="MacAddress", lFlags=0, pVal=0x53ef3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cdbe8*=0, plFlavor=0x22cdbec*=0 | out: pVal=0x53ef3c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="00:40:43:80:76:5A", varVal2=0x0), pType=0x22cdbe8*=8, plFlavor=0x22cdbec*=0) returned 0x0
	[0165.504] SysStringByteLen (bstr="00:40:43:80:76:5A") returned 0x22
	[0165.504] SysStringByteLen (bstr="00:40:43:80:76:5A") returned 0x22
	[0165.504] IWbemClassObject:Get (in: This=0xa97a50, wszName="MacAddress", lFlags=0, pVal=0x53ef44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cdbe8*=8, plFlavor=0x22cdbec*=0 | out: pVal=0x53ef44*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="00:40:43:80:76:5A", varVal2=0x0), pType=0x22cdbe8*=8, plFlavor=0x22cdbec*=0) returned 0x0
	[0165.505] SysStringByteLen (bstr="00:40:43:80:76:5A") returned 0x22
	[0165.505] SysStringByteLen (bstr="00:40:43:80:76:5A") returned 0x22
	[0165.507] IUnknown:Release (This=0xa97a50) returned 0x2
	[0165.507] CoTaskMemAlloc (cb=0x4) returned 0xa91bc0
	[0165.508] IEnumWbemClassObject:Next (in: This=0x9ef6f0, lTimeout=-1, uCount=0x1, apObjects=0xa91bc0, puReturned=0x22c61a8 | out: apObjects=0xa91bc0*=0x0, puReturned=0x22c61a8*=0x0) returned 0x1
	[0165.516] CoTaskMemFree (pv=0xa91bc0) 
	[0165.517] CoGetContextToken (in: pToken=0x53ee6c | out: pToken=0x53ee6c) returned 0x0
	[0165.517] IUnknown:Release (This=0x9ef6f0) returned 0x1
	[0165.517] IUnknown:Release (This=0x9ef6f0) returned 0x0
	[0165.607] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", nBufferLength=0x105, lpBuffer=0x53ea68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe", lpFilePart=0x0) returned 0x5f
	[0165.610] GetEnvironmentVariableW (in: lpName="%startupfolder%", lpBuffer=0x53edf8, nSize=0xd8 | out: lpBuffer="") returned 0x0
	[0165.705] GetUserNameW (in: lpBuffer=0x53eda8, pcbBuffer=0x22ce8f0 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x22ce8f0) returned 1
	[0165.710] GetComputerNameW (in: lpBuffer=0x53eda8, nSize=0x22ced64 | out: lpBuffer="Q9IATRKPRH", nSize=0x22ced64) returned 1
	[0165.769] EtwEventRegister () returned 0x0
	[0196.117] CoTaskMemAlloc (cb=0x20c) returned 0xa681f8
	[0196.117] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xa681f8 | out: pszPath="C:\\Windows\\system32") returned 0x0
	[0196.120] CoTaskMemFree (pv=0xa681f8) 
	[0196.121] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x53ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13
	[0196.129] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\drivers\\etc\\hosts", nBufferLength=0x105, lpBuffer=0x53e994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\drivers\\etc\\hosts", lpFilePart=0x0) returned 0x25
	[0196.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53eeac) returned 1
	[0196.129] CreateFileW (lpFileName="C:\\Windows\\system32\\drivers\\etc\\hosts" (normalized: "c:\\windows\\system32\\drivers\\etc\\hosts"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x318
	[0196.130] GetFileType (hFile=0x318) returned 0x1
	[0196.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53eea8) returned 1
	[0196.130] GetFileType (hFile=0x318) returned 0x1
	[0196.130] SetFilePointer (in: hFile=0x318, lDistanceToMove=0, lpDistanceToMoveHigh=0x53ee80*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x53ee80*=0) returned 0x338
	[0196.137] WriteFile (in: hFile=0x318, lpBuffer=0x22d1b8c*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x53ef50, lpOverlapped=0x0 | out: lpBuffer=0x22d1b8c*, lpNumberOfBytesWritten=0x53ef50*=0xb, lpOverlapped=0x0) returned 1
	[0196.140] CloseHandle (hObject=0x318) returned 1
	[0247.716] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", nBufferLength=0x105, lpBuffer=0x53e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", lpFilePart=0x0) returned 0x66
	[0247.719] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x53e920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
	[0247.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x53e8ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0247.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x53e950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0247.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53eb90) returned 1
	[0247.728] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x53ee54 | out: lpFileInformation=0x53ee54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1
	[0247.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53eb8c) returned 1
	[0247.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x53e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
	[0247.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53edb4) returned 1
	[0247.731] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328
	[0247.731] GetFileType (hFile=0x328) returned 0x1
	[0247.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53edb0) returned 1
	[0247.731] GetFileType (hFile=0x328) returned 0x1
	[0247.915] GetFileSize (in: hFile=0x328, lpFileSizeHigh=0x53ede0 | out: lpFileSizeHigh=0x53ede0*=0x0) returned 0x8c8e
	[0247.916] ReadFile (in: hFile=0x328, lpBuffer=0x22d8380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53ed9c, lpOverlapped=0x0 | out: lpBuffer=0x22d8380*, lpNumberOfBytesRead=0x53ed9c*=0x1000, lpOverlapped=0x0) returned 1
	[0247.919] ReadFile (in: hFile=0x328, lpBuffer=0x22d8380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53ed50, lpOverlapped=0x0 | out: lpBuffer=0x22d8380*, lpNumberOfBytesRead=0x53ed50*=0x1000, lpOverlapped=0x0) returned 1
	[0247.919] ReadFile (in: hFile=0x328, lpBuffer=0x22d8380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53eccc, lpOverlapped=0x0 | out: lpBuffer=0x22d8380*, lpNumberOfBytesRead=0x53eccc*=0x1000, lpOverlapped=0x0) returned 1
	[0247.919] ReadFile (in: hFile=0x328, lpBuffer=0x22d8380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53eccc, lpOverlapped=0x0 | out: lpBuffer=0x22d8380*, lpNumberOfBytesRead=0x53eccc*=0x1000, lpOverlapped=0x0) returned 1
	[0247.920] ReadFile (in: hFile=0x328, lpBuffer=0x22d8380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53eccc, lpOverlapped=0x0 | out: lpBuffer=0x22d8380*, lpNumberOfBytesRead=0x53eccc*=0x1000, lpOverlapped=0x0) returned 1
	[0247.920] ReadFile (in: hFile=0x328, lpBuffer=0x22d8380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53eccc, lpOverlapped=0x0 | out: lpBuffer=0x22d8380*, lpNumberOfBytesRead=0x53eccc*=0x1000, lpOverlapped=0x0) returned 1
	[0247.920] ReadFile (in: hFile=0x328, lpBuffer=0x22d8380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53ed4c, lpOverlapped=0x0 | out: lpBuffer=0x22d8380*, lpNumberOfBytesRead=0x53ed4c*=0x1000, lpOverlapped=0x0) returned 1
	[0247.921] ReadFile (in: hFile=0x328, lpBuffer=0x22d8380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53eccc, lpOverlapped=0x0 | out: lpBuffer=0x22d8380*, lpNumberOfBytesRead=0x53eccc*=0x1000, lpOverlapped=0x0) returned 1
	[0247.921] ReadFile (in: hFile=0x328, lpBuffer=0x22d8380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53eccc, lpOverlapped=0x0 | out: lpBuffer=0x22d8380*, lpNumberOfBytesRead=0x53eccc*=0xc8e, lpOverlapped=0x0) returned 1
	[0247.921] ReadFile (in: hFile=0x328, lpBuffer=0x22d8380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53ed78, lpOverlapped=0x0 | out: lpBuffer=0x22d8380*, lpNumberOfBytesRead=0x53ed78*=0x0, lpOverlapped=0x0) returned 1
	[0247.922] CloseHandle (hObject=0x328) returned 1
	[0247.922] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", nBufferLength=0x105, lpBuffer=0x53e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", lpFilePart=0x0) returned 0x66
	[0247.923] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", nBufferLength=0x105, lpBuffer=0x53e94c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config", lpFilePart=0x0) returned 0x66
	[0247.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53eb8c) returned 1
	[0247.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config" (normalized: "c:\\users\\keecfmwgj\\desktop\\85627117b351e81655bb56b947b61a198d195a225db0e002ef476460b9f273ac.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x53ee50 | out: lpFileInformation=0x53ee50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0247.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53eb88) returned 1
	[0248.753] CoTaskMemAlloc (cb=0x20c) returned 0xa645f8
	[0248.753] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa645f8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0248.760] CoTaskMemFree (pv=0xa645f8) 
	[0248.760] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0248.768] CoTaskMemAlloc (cb=0x20c) returned 0xa645f8
	[0248.768] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa645f8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0248.769] CoTaskMemFree (pv=0xa645f8) 
	[0248.769] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0249.481] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x33
	[0249.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Chromium\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\chromium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.484] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Comodo\\Dragon\\User Data", lpFilePart=0x0) returned 0x38
	[0249.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.484] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Comodo\\Dragon\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\comodo\\dragon\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.485] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpFilePart=0x0) returned 0x54
	[0249.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.485] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\fenrir inc\\sleipnir5\\setting\\modules\\chromiumviewer"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.486] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpFilePart=0x0) returned 0x41
	[0249.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\maplestudio\\chromeplus\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.487] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Opera Software\\Opera Stable", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Opera Software\\Opera Stable", lpFilePart=0x0) returned 0x3e
	[0249.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.487] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Opera Software\\Opera Stable" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\opera software\\opera stable"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.488] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\7Star\\7Star\\User Data", lpFilePart=0x0) returned 0x36
	[0249.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\7Star\\7Star\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\7star\\7star\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.489] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\CentBrowser\\User Data", lpFilePart=0x0) returned 0x36
	[0249.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\CentBrowser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\centbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.490] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Torch\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x30
	[0249.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Torch\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\torch\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.491] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Chedot\\User Data", lpFilePart=0x0) returned 0x31
	[0249.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Chedot\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\chedot\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.492] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpFilePart=0x0) returned 0x39
	[0249.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\uCozMedia\\Uran\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\ucozmedia\\uran\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.493] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Kometa\\User Data", lpFilePart=0x0) returned 0x31
	[0249.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Kometa\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\kometa\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.494] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpFilePart=0x0) returned 0x46
	[0249.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.494] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\bravesoftware\\brave-browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.495] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\QIP Surf\\User Data", lpFilePart=0x0) returned 0x33
	[0249.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.495] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\QIP Surf\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\qip surf\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.496] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x3f
	[0249.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.496] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Yandex\\YandexBrowser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\yandex\\yandexbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.498] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpFilePart=0x0) returned 0x3f
	[0249.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\catalinagroup\\citrio\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.499] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\360Chrome\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\360Chrome\\Chrome\\User Data", lpFilePart=0x0) returned 0x3b
	[0249.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.499] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\360Chrome\\Chrome\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\360chrome\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.500] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Iridium\\User Data", lpFilePart=0x0) returned 0x32
	[0249.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.500] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Iridium\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\iridium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.501] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Coowon\\Coowon\\User Data", lpFilePart=0x0) returned 0x38
	[0249.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.501] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Coowon\\Coowon\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\coowon\\coowon\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.502] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpFilePart=0x0) returned 0x3a
	[0249.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.502] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Sputnik\\Sputnik\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\sputnik\\sputnik\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.502] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\CocCoc\\Browser\\User Data", lpFilePart=0x0) returned 0x39
	[0249.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.503] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\CocCoc\\Browser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\coccoc\\browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.503] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Amigo\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Amigo\\User Data", lpFilePart=0x0) returned 0x30
	[0249.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Amigo\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\amigo\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.504] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Epic Privacy Browser\\User Data", lpFilePart=0x0) returned 0x3f
	[0249.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Epic Privacy Browser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\epic privacy browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.505] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\liebao\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\liebao\\User Data", lpFilePart=0x0) returned 0x31
	[0249.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\liebao\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\liebao\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.506] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Orbitum\\User Data", lpFilePart=0x0) returned 0x32
	[0249.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.507] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Orbitum\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\orbitum\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.507] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Vivaldi\\User Data", lpFilePart=0x0) returned 0x32
	[0249.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Vivaldi\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\vivaldi\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.508] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Elements Browser\\User Data", lpFilePart=0x0) returned 0x3b
	[0249.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0249.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Elements Browser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\elements browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0249.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0249.550] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x53d0c0, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0249.755] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", lpFilePart=0x0) returned 0x45
	[0249.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0249.756] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0249.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0249.928] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", lpFilePart=0x0) returned 0x45
	[0249.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0249.929] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0249.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0249.979] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x53e8ec, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0250.002] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\CoreFTP\\sites.idx", nBufferLength=0x105, lpBuffer=0x53e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\CoreFTP\\sites.idx", lpFilePart=0x0) returned 0x34
	[0250.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e9bc) returned 1
	[0250.002] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\CoreFTP\\sites.idx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\coreftp\\sites.idx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0250.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d7d8) returned 1
	[0250.083] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x53e988 | out: lpclsid=0x53e988*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0
	[0250.100] CoGetClassObject (in: rclsid=0xa144b4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53e5c0 | out: ppv=0x53e5c0*=0x1113c8) returned 0x0
	[0250.974] WshShell:IUnknown:QueryInterface (in: This=0x1113c8, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e7d8 | out: ppvObject=0x53e7d8*=0x0) returned 0x80004002
	[0250.974] WshShell:IClassFactory:CreateInstance (in: This=0x1113c8, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e7e4 | out: ppvObject=0x53e7e4*=0x11ff6c) returned 0x0
	[0250.974] WshShell:IUnknown:Release (This=0x1113c8) returned 0x0
	[0250.975] WshShell:IUnknown:QueryInterface (in: This=0x11ff6c, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e404 | out: ppvObject=0x53e404*=0x11ff6c) returned 0x0
	[0250.975] WshShell:IUnknown:QueryInterface (in: This=0x11ff6c, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e3b8 | out: ppvObject=0x53e3b8*=0x0) returned 0x80004002
	[0250.975] WshShell:IUnknown:QueryInterface (in: This=0x11ff6c, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e1e0 | out: ppvObject=0x53e1e0*=0x11ff5c) returned 0x0
	[0250.975] WshShell:IProvideClassInfo:GetClassInfo (in: This=0x11ff5c, ppTI=0x53e1e8 | out: ppTI=0x53e1e8*=0x573a078) returned 0x0
	[0250.987] ITypeInfo:RemoteGetTypeAttr (in: This=0x573a078, ppTypeAttr=0x53e1dc, pDummy=0x21362c44 | out: ppTypeAttr=0x53e1dc, pDummy=0x21362c44) returned 0x0
	[0250.987] ITypeInfo:LocalReleaseTypeAttr (This=0x573a078) returned 0xa132f0
	[0250.988] WshShell:IUnknown:Release (This=0x11ff5c) returned 0x2
	[0250.988] IUnknown:Release (This=0x573a078) returned 0x1
	[0250.988] WshShell:IUnknown:AddRef (This=0x11ff6c) returned 0x3
	[0250.988] WshShell:IUnknown:QueryInterface (in: This=0x11ff6c, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53dd14 | out: ppvObject=0x53dd14*=0x0) returned 0x80004002
	[0250.988] WshShell:IUnknown:QueryInterface (in: This=0x11ff6c, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53dcc4 | out: ppvObject=0x53dcc4*=0x0) returned 0x80004002
	[0250.988] WshShell:IUnknown:QueryInterface (in: This=0x11ff6c, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53dcd0 | out: ppvObject=0x53dcd0*=0x0) returned 0x80004002
	[0250.988] CoGetContextToken (in: pToken=0x53dd30 | out: pToken=0x53dd30) returned 0x0
	[0250.989] CoGetContextToken (in: pToken=0x53e144 | out: pToken=0x53e144) returned 0x0
	[0250.989] WshShell:IUnknown:QueryInterface (in: This=0x11ff6c, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e1c4 | out: ppvObject=0x53e1c4*=0x0) returned 0x80004002
	[0250.989] WshShell:IUnknown:Release (This=0x11ff6c) returned 0x2
	[0250.989] WshShell:IUnknown:Release (This=0x11ff6c) returned 0x1
	[0250.999] CoGetContextToken (in: pToken=0x53e554 | out: pToken=0x53e554) returned 0x0
	[0250.999] WshShell:IUnknown:QueryInterface (in: This=0x11ff6c, riid=0x724c6a28*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e5c4 | out: ppvObject=0x53e5c4*=0x11ff58) returned 0x0
	[0250.999] WshShell:IDispatch:GetIDsOfNames (in: This=0x11ff58, riid=0x72402d74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x53e5c0*="RegRead", cNames=0x1, lcid=0x409, rgDispId=0x53e5b0 | out: rgDispId=0x53e5b0*=2000) returned 0x0
	[0251.000] WshShell:IDispatch:Invoke (in: This=0x11ff58, dispIdMember=2000, riid=0x72402d74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x53e748*(rgvarg=([0]=0x53e5d0*(varType=0x4008, wReserved1=0x7275, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e5a0*="HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites\\Host", varVal2=0x22f89b0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x53e6c4, pExcepInfo=0x53e49c, puArgErr=0x53e500 | out: pDispParams=0x53e748*(rgvarg=([0]=0x53e5d0*(varType=0x4008, wReserved1=0x7275, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e5a0*="HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites\\Host", varVal2=0x22f89b0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x53e6c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x80070002, varVal2=0x14), pExcepInfo=0x53e49c*(wCode=0x0, wReserved=0x0, bstrSource="WshShell.RegRead", bstrDescription="Invalid root in registry key \"HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites\\Host\".", bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x80070002), puArgErr=0x53e500*=0x72468c8e) returned 0x80020009
	[0251.039] SysStringLen (param_1="Invalid root in registry key \"HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites\\Host\".") returned 0x55
	[0251.040] SysStringLen (param_1="WshShell.RegRead") returned 0x10
	[0251.053] WshShell:IUnknown:Release (This=0x11ff58) returned 0x1
	[0251.066] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x53e988 | out: lpclsid=0x53e988*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0
	[0251.072] CoGetClassObject (in: rclsid=0xa144b4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53e5c0 | out: ppv=0x53e5c0*=0x1113c8) returned 0x0
	[0251.072] WshShell:IUnknown:QueryInterface (in: This=0x1113c8, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e7d8 | out: ppvObject=0x53e7d8*=0x0) returned 0x80004002
	[0251.072] WshShell:IClassFactory:CreateInstance (in: This=0x1113c8, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e7e4 | out: ppvObject=0x53e7e4*=0x11ff9c) returned 0x0
	[0251.072] WshShell:IUnknown:Release (This=0x1113c8) returned 0x0
	[0251.073] WshShell:IUnknown:QueryInterface (in: This=0x11ff9c, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e404 | out: ppvObject=0x53e404*=0x11ff9c) returned 0x0
	[0251.073] WshShell:IUnknown:QueryInterface (in: This=0x11ff9c, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e3b8 | out: ppvObject=0x53e3b8*=0x0) returned 0x80004002
	[0251.073] WshShell:IUnknown:QueryInterface (in: This=0x11ff9c, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e1e0 | out: ppvObject=0x53e1e0*=0x11ff8c) returned 0x0
	[0251.073] WshShell:IProvideClassInfo:GetClassInfo (in: This=0x11ff8c, ppTI=0x53e1e8 | out: ppTI=0x53e1e8*=0x573a078) returned 0x0
	[0251.073] ITypeInfo:RemoteGetTypeAttr (in: This=0x573a078, ppTypeAttr=0x53e1dc, pDummy=0x21362c44 | out: ppTypeAttr=0x53e1dc, pDummy=0x21362c44) returned 0x0
	[0251.073] ITypeInfo:LocalReleaseTypeAttr (This=0x573a078) returned 0x9decc8
	[0251.073] WshShell:IUnknown:Release (This=0x11ff8c) returned 0x2
	[0251.073] IUnknown:Release (This=0x573a078) returned 0x1
	[0251.074] WshShell:IUnknown:AddRef (This=0x11ff9c) returned 0x3
	[0251.074] WshShell:IUnknown:QueryInterface (in: This=0x11ff9c, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53dd14 | out: ppvObject=0x53dd14*=0x0) returned 0x80004002
	[0251.074] WshShell:IUnknown:QueryInterface (in: This=0x11ff9c, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53dcc4 | out: ppvObject=0x53dcc4*=0x0) returned 0x80004002
	[0251.074] WshShell:IUnknown:QueryInterface (in: This=0x11ff9c, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53dcd0 | out: ppvObject=0x53dcd0*=0x0) returned 0x80004002
	[0251.074] CoGetContextToken (in: pToken=0x53dd30 | out: pToken=0x53dd30) returned 0x0
	[0251.075] CoGetContextToken (in: pToken=0x53e144 | out: pToken=0x53e144) returned 0x0
	[0251.075] WshShell:IUnknown:QueryInterface (in: This=0x11ff9c, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e1c4 | out: ppvObject=0x53e1c4*=0x0) returned 0x80004002
	[0251.075] WshShell:IUnknown:Release (This=0x11ff9c) returned 0x2
	[0251.075] WshShell:IUnknown:Release (This=0x11ff9c) returned 0x1
	[0251.075] CoGetContextToken (in: pToken=0x53e554 | out: pToken=0x53e554) returned 0x0
	[0251.075] WshShell:IUnknown:QueryInterface (in: This=0x11ff9c, riid=0x724c6a28*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e5c4 | out: ppvObject=0x53e5c4*=0x11ff88) returned 0x0
	[0251.076] WshShell:IDispatch:GetIDsOfNames (in: This=0x11ff88, riid=0x72402d74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x53e5c0*="RegRead", cNames=0x1, lcid=0x409, rgDispId=0x53e5b0 | out: rgDispId=0x53e5b0*=2000) returned 0x0
	[0251.076] WshShell:IDispatch:Invoke (in: This=0x11ff88, dispIdMember=2000, riid=0x72402d74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x53e748*(rgvarg=([0]=0x53e5d0*(varType=0x4008, wReserved1=0x7275, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e5a0*="HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesPort", varVal2=0x22f92ac)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x53e6c4, pExcepInfo=0x53e49c, puArgErr=0x53e500 | out: pDispParams=0x53e748*(rgvarg=([0]=0x53e5d0*(varType=0x4008, wReserved1=0x7275, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e5a0*="HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesPort", varVal2=0x22f92ac)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x53e6c4*(varType=0x0, wReserved1=0x0, wReserved2=0xd000, wReserved3=0x7efd, varVal1=0x80070003, varVal2=0x44), pExcepInfo=0x53e49c*(wCode=0x0, wReserved=0x0, bstrSource="WshShell.RegRead", bstrDescription="Invalid root in registry key \"HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesPort\".", bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x80070003), puArgErr=0x53e500*=0x72468c8e) returned 0x80020009
	[0251.080] SysStringLen (param_1="Invalid root in registry key \"HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesPort\".") returned 0x50
	[0251.080] SysStringLen (param_1="WshShell.RegRead") returned 0x10
	[0251.083] WshShell:IUnknown:Release (This=0x11ff88) returned 0x1
	[0251.093] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x53e988 | out: lpclsid=0x53e988*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0
	[0251.098] CoGetClassObject (in: rclsid=0xa144b4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53e5c0 | out: ppv=0x53e5c0*=0x11ffb8) returned 0x0
	[0251.098] WshShell:IUnknown:QueryInterface (in: This=0x11ffb8, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e7d8 | out: ppvObject=0x53e7d8*=0x0) returned 0x80004002
	[0251.099] WshShell:IClassFactory:CreateInstance (in: This=0x11ffb8, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e7e4 | out: ppvObject=0x53e7e4*=0x1113dc) returned 0x0
	[0251.099] WshShell:IUnknown:Release (This=0x11ffb8) returned 0x0
	[0251.099] WshShell:IUnknown:QueryInterface (in: This=0x1113dc, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e404 | out: ppvObject=0x53e404*=0x1113dc) returned 0x0
	[0251.099] WshShell:IUnknown:QueryInterface (in: This=0x1113dc, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e3b8 | out: ppvObject=0x53e3b8*=0x0) returned 0x80004002
	[0251.099] WshShell:IUnknown:QueryInterface (in: This=0x1113dc, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e1e0 | out: ppvObject=0x53e1e0*=0x1113cc) returned 0x0
	[0251.099] WshShell:IProvideClassInfo:GetClassInfo (in: This=0x1113cc, ppTI=0x53e1e8 | out: ppTI=0x53e1e8*=0x573a078) returned 0x0
	[0251.099] ITypeInfo:RemoteGetTypeAttr (in: This=0x573a078, ppTypeAttr=0x53e1dc, pDummy=0x21362c44 | out: ppTypeAttr=0x53e1dc, pDummy=0x21362c44) returned 0x0
	[0251.100] ITypeInfo:LocalReleaseTypeAttr (This=0x573a078) returned 0xa1dc20
	[0251.100] WshShell:IUnknown:Release (This=0x1113cc) returned 0x2
	[0251.100] IUnknown:Release (This=0x573a078) returned 0x1
	[0251.100] WshShell:IUnknown:AddRef (This=0x1113dc) returned 0x3
	[0251.100] WshShell:IUnknown:QueryInterface (in: This=0x1113dc, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53dd14 | out: ppvObject=0x53dd14*=0x0) returned 0x80004002
	[0251.101] WshShell:IUnknown:QueryInterface (in: This=0x1113dc, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53dcc4 | out: ppvObject=0x53dcc4*=0x0) returned 0x80004002
	[0251.101] WshShell:IUnknown:QueryInterface (in: This=0x1113dc, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53dcd0 | out: ppvObject=0x53dcd0*=0x0) returned 0x80004002
	[0251.101] CoGetContextToken (in: pToken=0x53dd30 | out: pToken=0x53dd30) returned 0x0
	[0251.101] CoGetContextToken (in: pToken=0x53e144 | out: pToken=0x53e144) returned 0x0
	[0251.101] WshShell:IUnknown:QueryInterface (in: This=0x1113dc, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e1c4 | out: ppvObject=0x53e1c4*=0x0) returned 0x80004002
	[0251.101] WshShell:IUnknown:Release (This=0x1113dc) returned 0x2
	[0251.101] WshShell:IUnknown:Release (This=0x1113dc) returned 0x1
	[0251.101] CoGetContextToken (in: pToken=0x53e554 | out: pToken=0x53e554) returned 0x0
	[0251.101] WshShell:IUnknown:QueryInterface (in: This=0x1113dc, riid=0x724c6a28*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e5c4 | out: ppvObject=0x53e5c4*=0x1113c8) returned 0x0
	[0251.102] WshShell:IDispatch:GetIDsOfNames (in: This=0x1113c8, riid=0x72402d74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x53e5c0*="RegRead", cNames=0x1, lcid=0x409, rgDispId=0x53e5b0 | out: rgDispId=0x53e5b0*=2000) returned 0x0
	[0251.102] WshShell:IDispatch:Invoke (in: This=0x1113c8, dispIdMember=2000, riid=0x72402d74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x53e748*(rgvarg=([0]=0x53e5d0*(varType=0x4008, wReserved1=0x7275, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e5a0*="HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesUser", varVal2=0x22f99b8)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x53e6c4, pExcepInfo=0x53e49c, puArgErr=0x53e500 | out: pDispParams=0x53e748*(rgvarg=([0]=0x53e5d0*(varType=0x4008, wReserved1=0x7275, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e5a0*="HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesUser", varVal2=0x22f99b8)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x53e6c4*(varType=0x0, wReserved1=0x0, wReserved2=0xd000, wReserved3=0x7efd, varVal1=0x80070003, varVal2=0x44), pExcepInfo=0x53e49c*(wCode=0x0, wReserved=0x0, bstrSource="WshShell.RegRead", bstrDescription="Invalid root in registry key \"HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesUser\".", bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x80070003), puArgErr=0x53e500*=0x72468c8e) returned 0x80020009
	[0251.104] SysStringLen (param_1="Invalid root in registry key \"HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesUser\".") returned 0x50
	[0251.104] SysStringLen (param_1="WshShell.RegRead") returned 0x10
	[0251.107] WshShell:IUnknown:Release (This=0x1113c8) returned 0x1
	[0251.114] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x53e988 | out: lpclsid=0x53e988*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0
	[0251.118] CoGetClassObject (in: rclsid=0xa144b4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53e5c0 | out: ppv=0x53e5c0*=0x11ffb8) returned 0x0
	[0251.119] WshShell:IUnknown:QueryInterface (in: This=0x11ffb8, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e7d8 | out: ppvObject=0x53e7d8*=0x0) returned 0x80004002
	[0251.119] WshShell:IClassFactory:CreateInstance (in: This=0x11ffb8, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e7e4 | out: ppvObject=0x53e7e4*=0x112acc) returned 0x0
	[0251.119] WshShell:IUnknown:Release (This=0x11ffb8) returned 0x0
	[0251.119] WshShell:IUnknown:QueryInterface (in: This=0x112acc, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e404 | out: ppvObject=0x53e404*=0x112acc) returned 0x0
	[0251.119] WshShell:IUnknown:QueryInterface (in: This=0x112acc, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e3b8 | out: ppvObject=0x53e3b8*=0x0) returned 0x80004002
	[0251.119] WshShell:IUnknown:QueryInterface (in: This=0x112acc, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e1e0 | out: ppvObject=0x53e1e0*=0x112abc) returned 0x0
	[0251.120] WshShell:IProvideClassInfo:GetClassInfo (in: This=0x112abc, ppTI=0x53e1e8 | out: ppTI=0x53e1e8*=0x573a078) returned 0x0
	[0251.120] ITypeInfo:RemoteGetTypeAttr (in: This=0x573a078, ppTypeAttr=0x53e1dc, pDummy=0x21362c44 | out: ppTypeAttr=0x53e1dc, pDummy=0x21362c44) returned 0x0
	[0251.120] ITypeInfo:LocalReleaseTypeAttr (This=0x573a078) returned 0xa1dc20
	[0251.120] WshShell:IUnknown:Release (This=0x112abc) returned 0x2
	[0251.120] IUnknown:Release (This=0x573a078) returned 0x1
	[0251.120] WshShell:IUnknown:AddRef (This=0x112acc) returned 0x3
	[0251.120] WshShell:IUnknown:QueryInterface (in: This=0x112acc, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53dd14 | out: ppvObject=0x53dd14*=0x0) returned 0x80004002
	[0251.121] WshShell:IUnknown:QueryInterface (in: This=0x112acc, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53dcc4 | out: ppvObject=0x53dcc4*=0x0) returned 0x80004002
	[0251.121] WshShell:IUnknown:QueryInterface (in: This=0x112acc, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53dcd0 | out: ppvObject=0x53dcd0*=0x0) returned 0x80004002
	[0251.121] CoGetContextToken (in: pToken=0x53dd30 | out: pToken=0x53dd30) returned 0x0
	[0251.121] CoGetContextToken (in: pToken=0x53e144 | out: pToken=0x53e144) returned 0x0
	[0251.121] WshShell:IUnknown:QueryInterface (in: This=0x112acc, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e1c4 | out: ppvObject=0x53e1c4*=0x0) returned 0x80004002
	[0251.121] WshShell:IUnknown:Release (This=0x112acc) returned 0x2
	[0251.121] WshShell:IUnknown:Release (This=0x112acc) returned 0x1
	[0251.121] CoGetContextToken (in: pToken=0x53e554 | out: pToken=0x53e554) returned 0x0
	[0251.121] WshShell:IUnknown:QueryInterface (in: This=0x112acc, riid=0x724c6a28*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e5c4 | out: ppvObject=0x53e5c4*=0x112ab8) returned 0x0
	[0251.122] WshShell:IDispatch:GetIDsOfNames (in: This=0x112ab8, riid=0x72402d74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x53e5c0*="RegRead", cNames=0x1, lcid=0x409, rgDispId=0x53e5b0 | out: rgDispId=0x53e5b0*=2000) returned 0x0
	[0251.122] WshShell:IDispatch:Invoke (in: This=0x112ab8, dispIdMember=2000, riid=0x72402d74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x53e748*(rgvarg=([0]=0x53e5d0*(varType=0x4008, wReserved1=0x7275, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e5a0*="HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesPW", varVal2=0x22fa008)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x53e6c4, pExcepInfo=0x53e49c, puArgErr=0x53e500 | out: pDispParams=0x53e748*(rgvarg=([0]=0x53e5d0*(varType=0x4008, wReserved1=0x7275, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e5a0*="HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesPW", varVal2=0x22fa008)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x53e6c4*(varType=0x0, wReserved1=0x0, wReserved2=0xd000, wReserved3=0x7efd, varVal1=0x80070003, varVal2=0x3e), pExcepInfo=0x53e49c*(wCode=0x0, wReserved=0x0, bstrSource="WshShell.RegRead", bstrDescription="Invalid root in registry key \"HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesPW\".", bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x80070003), puArgErr=0x53e500*=0x72468c8e) returned 0x80020009
	[0251.124] SysStringLen (param_1="Invalid root in registry key \"HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesPW\".") returned 0x4e
	[0251.124] SysStringLen (param_1="WshShell.RegRead") returned 0x10
	[0251.128] WshShell:IUnknown:Release (This=0x112ab8) returned 0x1
	[0251.174] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x53e988 | out: lpclsid=0x53e988*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0
	[0251.179] CoGetClassObject (in: rclsid=0xa144b4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53e5c0 | out: ppv=0x53e5c0*=0x11ffb8) returned 0x0
	[0251.180] WshShell:IUnknown:QueryInterface (in: This=0x11ffb8, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e7d8 | out: ppvObject=0x53e7d8*=0x0) returned 0x80004002
	[0251.180] WshShell:IClassFactory:CreateInstance (in: This=0x11ffb8, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e7e4 | out: ppvObject=0x53e7e4*=0x112afc) returned 0x0
	[0251.180] WshShell:IUnknown:Release (This=0x11ffb8) returned 0x0
	[0251.180] WshShell:IUnknown:QueryInterface (in: This=0x112afc, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e404 | out: ppvObject=0x53e404*=0x112afc) returned 0x0
	[0251.180] WshShell:IUnknown:QueryInterface (in: This=0x112afc, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e3b8 | out: ppvObject=0x53e3b8*=0x0) returned 0x80004002
	[0251.180] WshShell:IUnknown:QueryInterface (in: This=0x112afc, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53e1e0 | out: ppvObject=0x53e1e0*=0x112aec) returned 0x0
	[0251.180] WshShell:IProvideClassInfo:GetClassInfo (in: This=0x112aec, ppTI=0x53e1e8 | out: ppTI=0x53e1e8*=0x573a078) returned 0x0
	[0251.181] ITypeInfo:RemoteGetTypeAttr (in: This=0x573a078, ppTypeAttr=0x53e1dc, pDummy=0x21362c44 | out: ppTypeAttr=0x53e1dc, pDummy=0x21362c44) returned 0x0
	[0251.181] ITypeInfo:LocalReleaseTypeAttr (This=0x573a078) returned 0xa9a688
	[0251.181] WshShell:IUnknown:Release (This=0x112aec) returned 0x2
	[0251.181] IUnknown:Release (This=0x573a078) returned 0x1
	[0251.181] WshShell:IUnknown:AddRef (This=0x112afc) returned 0x3
	[0251.181] WshShell:IUnknown:QueryInterface (in: This=0x112afc, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53dd14 | out: ppvObject=0x53dd14*=0x0) returned 0x80004002
	[0251.181] WshShell:IUnknown:QueryInterface (in: This=0x112afc, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53dcc4 | out: ppvObject=0x53dcc4*=0x0) returned 0x80004002
	[0251.181] WshShell:IUnknown:QueryInterface (in: This=0x112afc, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53dcd0 | out: ppvObject=0x53dcd0*=0x0) returned 0x80004002
	[0251.182] CoGetContextToken (in: pToken=0x53dd30 | out: pToken=0x53dd30) returned 0x0
	[0251.182] CoGetContextToken (in: pToken=0x53e144 | out: pToken=0x53e144) returned 0x0
	[0251.182] WshShell:IUnknown:QueryInterface (in: This=0x112afc, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e1c4 | out: ppvObject=0x53e1c4*=0x0) returned 0x80004002
	[0251.182] WshShell:IUnknown:Release (This=0x112afc) returned 0x2
	[0251.182] WshShell:IUnknown:Release (This=0x112afc) returned 0x1
	[0251.182] CoGetContextToken (in: pToken=0x53e554 | out: pToken=0x53e554) returned 0x0
	[0251.183] WshShell:IUnknown:QueryInterface (in: This=0x112afc, riid=0x724c6a28*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e5c4 | out: ppvObject=0x53e5c4*=0x112ae8) returned 0x0
	[0251.183] WshShell:IDispatch:GetIDsOfNames (in: This=0x112ae8, riid=0x72402d74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x53e5c0*="RegRead", cNames=0x1, lcid=0x409, rgDispId=0x53e5b0 | out: rgDispId=0x53e5b0*=2000) returned 0x0
	[0251.183] WshShell:IDispatch:Invoke (in: This=0x112ae8, dispIdMember=2000, riid=0x72402d74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x53e748*(rgvarg=([0]=0x53e5d0*(varType=0x4008, wReserved1=0x7275, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e5a0*="HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesName", varVal2=0x22fa650)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x53e6c4, pExcepInfo=0x53e49c, puArgErr=0x53e500 | out: pDispParams=0x53e748*(rgvarg=([0]=0x53e5d0*(varType=0x4008, wReserved1=0x7275, wReserved2=0x0, wReserved3=0x0, varVal1=0x53e5a0*="HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesName", varVal2=0x22fa650)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x53e6c4*(varType=0x0, wReserved1=0x0, wReserved2=0xd000, wReserved3=0x7efd, varVal1=0x80070003, varVal2=0x38), pExcepInfo=0x53e49c*(wCode=0x0, wReserved=0x0, bstrSource="WshShell.RegRead", bstrDescription="Invalid root in registry key \"HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesName\".", bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x80070003), puArgErr=0x53e500*=0x72468c8e) returned 0x80020009
	[0251.185] SysStringLen (param_1="Invalid root in registry key \"HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesName\".") returned 0x50
	[0251.185] SysStringLen (param_1="WshShell.RegRead") returned 0x10
	[0251.190] WshShell:IUnknown:Release (This=0x112ae8) returned 0x1
	[0251.303] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea30 | out: phkResult=0x53ea30*=0x0) returned 0x2
	[0251.309] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea30 | out: phkResult=0x53ea30*=0x0) returned 0x2
	[0251.314] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea30 | out: phkResult=0x53ea30*=0x0) returned 0x2
	[0251.321] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea30 | out: phkResult=0x53ea30*=0x328) returned 0x0
	[0251.322] RegQueryInfoKeyW (in: hKey=0x328, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x53ea58, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x53ea54, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x53ea58*=0x3, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x53ea54*=0x6, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0251.323] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x0, lpName=0x22fb8f8, lpcchName=0x53ea74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000001", lpcchName=0x53ea74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0251.323] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x1, lpName=0x22fb8f8, lpcchName=0x53ea74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000002", lpcchName=0x53ea74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0251.323] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x2, lpName=0x22fb8f8, lpcchName=0x53ea74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000003", lpcchName=0x53ea74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
	[0251.324] RegOpenKeyExW (in: hKey=0x328, lpSubKey="00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea30 | out: phkResult=0x53ea30*=0x324) returned 0x0
	[0251.329] RegQueryValueExW (in: hKey=0x324, lpValueName="Email", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.330] RegQueryValueExW (in: hKey=0x324, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.332] RegQueryValueExW (in: hKey=0x324, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.334] RegQueryValueExW (in: hKey=0x324, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.335] RegQueryValueExW (in: hKey=0x324, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.335] RegCloseKey (hKey=0x324) returned 0x0
	[0251.336] RegOpenKeyExW (in: hKey=0x328, lpSubKey="00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea30 | out: phkResult=0x53ea30*=0x324) returned 0x0
	[0251.336] RegQueryValueExW (in: hKey=0x324, lpValueName="Email", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x1, lpData=0x0, lpcbData=0x53ea4c*=0x1e) returned 0x0
	[0251.336] RegQueryValueExW (in: hKey=0x324, lpValueName="Email", lpReserved=0x0, lpType=0x53ea50, lpData=0x22fbeec, lpcbData=0x53ea4c*=0x1e | out: lpType=0x53ea50*=0x1, lpData="franc@gdllo.de", lpcbData=0x53ea4c*=0x1e) returned 0x0
	[0251.336] RegQueryValueExW (in: hKey=0x324, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.336] RegQueryValueExW (in: hKey=0x324, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x3, lpData=0x0, lpcbData=0x53ea4c*=0x111) returned 0x0
	[0251.337] RegQueryValueExW (in: hKey=0x324, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x22fbf50, lpcbData=0x53ea4c*=0x111 | out: lpType=0x53ea50*=0x3, lpData=0x22fbf50*, lpcbData=0x53ea4c*=0x111) returned 0x0
	[0251.337] RegQueryValueExW (in: hKey=0x324, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.337] RegQueryValueExW (in: hKey=0x324, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.337] RegQueryValueExW (in: hKey=0x324, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.337] RegQueryValueExW (in: hKey=0x324, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x3, lpData=0x0, lpcbData=0x53ea4c*=0x111) returned 0x0
	[0251.337] RegQueryValueExW (in: hKey=0x324, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x22fc0a4, lpcbData=0x53ea4c*=0x111 | out: lpType=0x53ea50*=0x3, lpData=0x22fc0a4*, lpcbData=0x53ea4c*=0x111) returned 0x0
	[0251.338] RegQueryValueExW (in: hKey=0x324, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x3, lpData=0x0, lpcbData=0x53ea4c*=0x111) returned 0x0
	[0251.338] RegQueryValueExW (in: hKey=0x324, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x22fc1c4, lpcbData=0x53ea4c*=0x111 | out: lpType=0x53ea50*=0x3, lpData=0x22fc1c4*, lpcbData=0x53ea4c*=0x111) returned 0x0
	[0251.539] CryptUnprotectData (in: pDataIn=0x53ea38, ppszDataDescr=0x0, pOptionalEntropy=0x53ea30, pvReserved=0x0, pPromptStruct=0x0, dwFlags=0x1, pDataOut=0x53ea40 | out: ppszDataDescr=0x0, pDataOut=0x53ea40) returned 1
	[0251.635] LocalFree (hMem=0x573f2f8) returned 0x0
	[0251.636] RegQueryValueExW (in: hKey=0x324, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.636] RegQueryValueExW (in: hKey=0x324, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.637] RegQueryValueExW (in: hKey=0x324, lpValueName="Email", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x1, lpData=0x0, lpcbData=0x53ea4c*=0x1e) returned 0x0
	[0251.637] RegQueryValueExW (in: hKey=0x324, lpValueName="Email", lpReserved=0x0, lpType=0x53ea50, lpData=0x22fc4b0, lpcbData=0x53ea4c*=0x1e | out: lpType=0x53ea50*=0x1, lpData="franc@gdllo.de", lpcbData=0x53ea4c*=0x1e) returned 0x0
	[0251.642] RegQueryValueExW (in: hKey=0x324, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x1, lpData=0x0, lpcbData=0x53ea4c*=0x1c) returned 0x0
	[0251.642] RegQueryValueExW (in: hKey=0x324, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x53ea50, lpData=0x22fc52c, lpcbData=0x53ea4c*=0x1c | out: lpType=0x53ea50*=0x1, lpData="smtp.gdllo.de", lpcbData=0x53ea4c*=0x1c) returned 0x0
	[0251.642] RegQueryValueExW (in: hKey=0x324, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x1, lpData=0x0, lpcbData=0x53ea4c*=0x1c) returned 0x0
	[0251.642] RegQueryValueExW (in: hKey=0x324, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x53ea50, lpData=0x22fc57c, lpcbData=0x53ea4c*=0x1c | out: lpType=0x53ea50*=0x1, lpData="smtp.gdllo.de", lpcbData=0x53ea4c*=0x1c) returned 0x0
	[0251.654] RegCloseKey (hKey=0x324) returned 0x0
	[0251.655] RegOpenKeyExW (in: hKey=0x328, lpSubKey="00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea30 | out: phkResult=0x53ea30*=0x324) returned 0x0
	[0251.655] RegQueryValueExW (in: hKey=0x324, lpValueName="Email", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.655] RegQueryValueExW (in: hKey=0x324, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.655] RegQueryValueExW (in: hKey=0x324, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.656] RegQueryValueExW (in: hKey=0x324, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.656] RegQueryValueExW (in: hKey=0x324, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x53ea50, lpData=0x0, lpcbData=0x53ea4c*=0x0 | out: lpType=0x53ea50*=0x0, lpData=0x0, lpcbData=0x53ea4c*=0x0) returned 0x2
	[0251.656] RegCloseKey (hKey=0x324) returned 0x0
	[0251.767] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x53e884, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0251.775] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Pocomail\\accounts.ini", nBufferLength=0x105, lpBuffer=0x53e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Pocomail\\accounts.ini", lpFilePart=0x0) returned 0x38
	[0251.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7b0) returned 1
	[0251.776] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Pocomail\\accounts.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\pocomail\\accounts.ini"), fInfoLevelId=0x0, lpFileInformation=0x53ea74 | out: lpFileInformation=0x53ea74*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0251.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7ac) returned 1
	[0251.807] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x53e8ac, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0251.813] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x53e8ac, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0251.827] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml", nBufferLength=0x105, lpBuffer=0x53e554, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml", lpFilePart=0x0) returned 0x54
	[0251.828] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", nBufferLength=0x105, lpBuffer=0x53e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", lpFilePart=0x0) returned 0x4e
	[0251.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53ea20) returned 1
	[0251.832] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", nBufferLength=0x105, lpBuffer=0x53e500, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", lpFilePart=0x0) returned 0x4e
	[0251.834] FindFirstFileW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml", lpFindFileData=0x53e7d0 | out: lpFindFileData=0x53e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0251.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e790) returned 1
	[0251.873] SetErrorInfo (dwReserved=0x0, perrinfo=0x573fa7c) returned 0x0
	[0251.876] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", nBufferLength=0x105, lpBuffer=0x53e5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", lpFilePart=0x0) returned 0x4f
	[0251.948] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x53e8b0, nSize=0xd8 | out: lpBuffer="") returned 0x2
	[0251.950] GetFullPathNameW (in: lpFileName="C:\\FTP Navigator\\Ftplist.txt", nBufferLength=0x105, lpBuffer=0x53e458, lpFilePart=0x0 | out: lpBuffer="C:\\FTP Navigator\\Ftplist.txt", lpFilePart=0x0) returned 0x1c
	[0251.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e970) returned 1
	[0251.951] CreateFileW (lpFileName="C:\\FTP Navigator\\Ftplist.txt" (normalized: "c:\\ftp navigator\\ftplist.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0251.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d790) returned 1
	[0252.028] CoTaskMemAlloc (cb=0x20c) returned 0xa9d3b8
	[0252.029] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa9d3b8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0252.029] CoTaskMemFree (pv=0xa9d3b8) 
	[0252.029] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e438, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0252.035] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Claws-mail", nBufferLength=0x105, lpBuffer=0x53e4c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Claws-mail", lpFilePart=0x0) returned 0x2d
	[0252.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e704) returned 1
	[0252.036] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Claws-mail" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\claws-mail"), fInfoLevelId=0x0, lpFileInformation=0x53e9c8 | out: lpFileInformation=0x53e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e700) returned 1
	[0252.040] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Claws-mail\\clawsrc", nBufferLength=0x105, lpBuffer=0x53e4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Claws-mail\\clawsrc", lpFilePart=0x0) returned 0x35
	[0252.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e710) returned 1
	[0252.040] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Claws-mail\\clawsrc" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\claws-mail\\clawsrc"), fInfoLevelId=0x0, lpFileInformation=0x53e9d4 | out: lpFileInformation=0x53e9d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e70c) returned 1
	[0252.051] CoTaskMemAlloc (cb=0x20c) returned 0xa9d3b8
	[0252.051] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa9d3b8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0252.051] CoTaskMemFree (pv=0xa9d3b8) 
	[0252.051] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e52c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0252.057] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x53e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x39
	[0252.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e78c) returned 1
	[0252.057] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Google\\Chrome\\User Data\\" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\google\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea50 | out: lpFileInformation=0x53ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e788) returned 1
	[0252.065] CoTaskMemAlloc (cb=0x20c) returned 0xa9d3b8
	[0252.065] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa9d3b8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0252.065] CoTaskMemFree (pv=0xa9d3b8) 
	[0252.066] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e504, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0252.073] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Tencent\\QQBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x53e594, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Tencent\\QQBrowser\\User Data", lpFilePart=0x0) returned 0x3c
	[0252.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7d0) returned 1
	[0252.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Tencent\\QQBrowser\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\tencent\\qqbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53ea94 | out: lpFileInformation=0x53ea94*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7cc) returned 1
	[0252.073] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", nBufferLength=0x105, lpBuffer=0x53e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", lpFilePart=0x0) returned 0x55
	[0252.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7dc) returned 1
	[0252.074] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\tencent\\qqbrowser\\user data\\default\\encryptedstorage"), fInfoLevelId=0x0, lpFileInformation=0x53eaa0 | out: lpFileInformation=0x53eaa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7d8) returned 1
	[0252.091] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", lpFilePart=0x0) returned 0x3e
	[0252.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0252.091] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mozilla\\icecat\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0252.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0252.099] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", lpFilePart=0x0) returned 0x3e
	[0252.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0252.100] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mozilla\\icecat\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0252.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0252.169] ExpandEnvironmentStringsW (in: lpSrc="%ProgramW6432%", lpDst=0x53e994, nSize=0x64 | out: lpDst="C:\\Program Files") returned 0x11
	[0252.169] ExpandEnvironmentStringsW (in: lpSrc="%ProgramW6432%", lpDst=0x53e994, nSize=0x64 | out: lpDst="C:\\Program Files") returned 0x11
	[0252.172] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x53e8cc, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0252.174] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Private Internet Access\\data", nBufferLength=0x105, lpBuffer=0x53e5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Private Internet Access\\data", lpFilePart=0x0) returned 0x2d
	[0252.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7ec) returned 1
	[0252.175] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Private Internet Access\\data" (normalized: "c:\\program files\\private internet access\\data"), fInfoLevelId=0x0, lpFileInformation=0x53eab0 | out: lpFileInformation=0x53eab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7e8) returned 1
	[0252.175] GetFullPathNameW (in: lpFileName="\\Private Internet Access\\data", nBufferLength=0x105, lpBuffer=0x53e5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Private Internet Access\\data", lpFilePart=0x0) returned 0x1f
	[0252.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7ec) returned 1
	[0252.175] GetFileAttributesExW (in: lpFileName="C:\\Private Internet Access\\data" (normalized: "c:\\private internet access\\data"), fInfoLevelId=0x0, lpFileInformation=0x53eab0 | out: lpFileInformation=0x53eab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7e8) returned 1
	[0252.205] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x53e8a0, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0252.206] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FileZilla\\recentservers.xml", nBufferLength=0x105, lpBuffer=0x53e464, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FileZilla\\recentservers.xml", lpFilePart=0x0) returned 0x3e
	[0252.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e97c) returned 1
	[0252.207] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0252.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d798) returned 1
	[0252.228] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Waterfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Waterfox\\profiles.ini", lpFilePart=0x0) returned 0x38
	[0252.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0252.229] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Waterfox\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\waterfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0252.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0252.237] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Waterfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Waterfox\\profiles.ini", lpFilePart=0x0) returned 0x38
	[0252.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0252.237] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Waterfox\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\waterfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0252.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0252.289] CoTaskMemAlloc (cb=0x20c) returned 0xa9d3b8
	[0252.289] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa9d3b8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0252.289] CoTaskMemFree (pv=0xa9d3b8) 
	[0252.289] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e500, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0252.291] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", nBufferLength=0x105, lpBuffer=0x53e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", lpFilePart=0x0) returned 0x41
	[0252.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7d8) returned 1
	[0252.291] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\opera mail\\opera mail\\wand.dat"), fInfoLevelId=0x0, lpFileInformation=0x53ea9c | out: lpFileInformation=0x53ea9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7d4) returned 1
	[0252.432] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\FoxmailPreview", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e924 | out: phkResult=0x53e924*=0x0) returned 0x2
	[0252.434] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\Foxmail\\V3.1", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e924 | out: phkResult=0x53e924*=0x0) returned 0x2
	[0252.436] GetFullPathNameW (in: lpFileName="\\Storage\\", nBufferLength=0x105, lpBuffer=0x53e468, lpFilePart=0x0 | out: lpBuffer="C:\\Storage\\", lpFilePart=0x0) returned 0xb
	[0252.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e6a4) returned 1
	[0252.436] GetFileAttributesExW (in: lpFileName="C:\\Storage\\" (normalized: "c:\\storage"), fInfoLevelId=0x0, lpFileInformation=0x53e968 | out: lpFileInformation=0x53e968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6a0) returned 1
	[0252.439] GetFullPathNameW (in: lpFileName="\\mail\\", nBufferLength=0x105, lpBuffer=0x53e468, lpFilePart=0x0 | out: lpBuffer="C:\\mail\\", lpFilePart=0x0) returned 0x8
	[0252.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e6a4) returned 1
	[0252.439] GetFileAttributesExW (in: lpFileName="C:\\mail\\" (normalized: "c:\\mail"), fInfoLevelId=0x0, lpFileInformation=0x53e968 | out: lpFileInformation=0x53e968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6a0) returned 1
	[0252.439] CoTaskMemAlloc (cb=0x20c) returned 0xa9d3b8
	[0252.439] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa9d3b8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0252.440] CoTaskMemFree (pv=0xa9d3b8) 
	[0252.440] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0252.445] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\", nBufferLength=0x105, lpBuffer=0x53e468, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\", lpFilePart=0x0) returned 0x49
	[0252.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e6a4) returned 1
	[0252.446] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\virtualstore\\program files\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x53e968 | out: lpFileInformation=0x53e968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6a0) returned 1
	[0252.447] CoTaskMemAlloc (cb=0x20c) returned 0xa9d3b8
	[0252.447] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa9d3b8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0252.447] CoTaskMemFree (pv=0xa9d3b8) 
	[0252.447] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0252.464] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\", nBufferLength=0x105, lpBuffer=0x53e468, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\", lpFilePart=0x0) returned 0x4f
	[0252.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e6a4) returned 1
	[0252.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\virtualstore\\program files (x86)\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x53e968 | out: lpFileInformation=0x53e968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6a0) returned 1
	[0252.495] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Postbox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Postbox\\profiles.ini", lpFilePart=0x0) returned 0x37
	[0252.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0252.496] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Postbox\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\postbox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0252.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0252.506] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Postbox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Postbox\\profiles.ini", lpFilePart=0x0) returned 0x37
	[0252.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0252.506] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Postbox\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\postbox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0252.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0252.588] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Flock\\Browser\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Flock\\Browser\\profiles.ini", lpFilePart=0x0) returned 0x3d
	[0252.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e940) returned 1
	[0252.589] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Flock\\Browser\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\flock\\browser\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0252.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d760) returned 1
	[0252.810] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x53e87c, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0252.816] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x53e87c, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0252.818] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Psi\\profiles", nBufferLength=0x105, lpBuffer=0x53e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Psi\\profiles", lpFilePart=0x0) returned 0x2f
	[0252.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7ac) returned 1
	[0252.818] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Psi\\profiles" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\psi\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x53ea70 | out: lpFileInformation=0x53ea70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7a8) returned 1
	[0252.819] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Psi+\\profiles", nBufferLength=0x105, lpBuffer=0x53e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Psi+\\profiles", lpFilePart=0x0) returned 0x30
	[0252.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7ac) returned 1
	[0252.819] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Psi+\\profiles" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\psi+\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x53ea70 | out: lpFileInformation=0x53ea70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7a8) returned 1
	[0252.875] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x53e8c4, nSize=0xd8 | out: lpBuffer="") returned 0x2
	[0252.881] GetFullPathNameW (in: lpFileName="C:\\cftp\\Ftplist.txt", nBufferLength=0x105, lpBuffer=0x53e5b0, lpFilePart=0x0 | out: lpBuffer="C:\\cftp\\Ftplist.txt", lpFilePart=0x0) returned 0x13
	[0252.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7f0) returned 1
	[0252.881] GetFileAttributesExW (in: lpFileName="C:\\cftp\\Ftplist.txt" (normalized: "c:\\cftp\\ftplist.txt"), fInfoLevelId=0x0, lpFileInformation=0x53eab4 | out: lpFileInformation=0x53eab4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0252.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7ec) returned 1
	[0252.966] CoTaskMemAlloc (cb=0x20c) returned 0xa9d3b8
	[0252.966] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa9d3b8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0252.966] CoTaskMemFree (pv=0xa9d3b8) 
	[0252.966] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0252.969] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x53e58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x37
	[0252.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7c8) returned 1
	[0252.969] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Credentials\\" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x53ea8c | out: lpFileInformation=0x53ea8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0252.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7c4) returned 1
	[0252.970] CoTaskMemAlloc (cb=0x20c) returned 0xa9d3b8
	[0252.970] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa9d3b8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0252.970] CoTaskMemFree (pv=0xa9d3b8) 
	[0252.970] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0252.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53ea88) returned 1
	[0252.971] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x53e568, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x37
	[0252.971] FindFirstFileW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x53e838 | out: lpFindFileData=0x53e838*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa2a3e8
	[0252.974] FindNextFileW (in: hFindFile=0xa2a3e8, lpFindFileData=0x53e840 | out: lpFindFileData=0x53e840*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.974] FindNextFileW (in: hFindFile=0xa2a3e8, lpFindFileData=0x53e840 | out: lpFindFileData=0x53e840*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0252.974] FindClose (in: hFindFile=0xa2a3e8 | out: hFindFile=0xa2a3e8) returned 1
	[0252.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7f8) returned 1
	[0252.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53ea58) returned 1
	[0252.977] CoTaskMemAlloc (cb=0x20c) returned 0xa9f898
	[0252.977] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa9f898 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0252.977] CoTaskMemFree (pv=0xa9f898) 
	[0252.977] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0252.978] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x53e58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x39
	[0252.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7c8) returned 1
	[0252.978] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Credentials\\" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x53ea8c | out: lpFileInformation=0x53ea8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0252.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7c4) returned 1
	[0252.978] CoTaskMemAlloc (cb=0x20c) returned 0xa9f898
	[0252.978] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa9f898 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0252.978] CoTaskMemFree (pv=0xa9f898) 
	[0252.978] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0252.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53ea88) returned 1
	[0252.979] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x53e568, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x39
	[0252.979] FindFirstFileW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x53e838 | out: lpFindFileData=0x53e838*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa2a3e8
	[0252.979] FindNextFileW (in: hFindFile=0xa2a3e8, lpFindFileData=0x53e840 | out: lpFindFileData=0x53e840*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.979] FindNextFileW (in: hFindFile=0xa2a3e8, lpFindFileData=0x53e840 | out: lpFindFileData=0x53e840*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0252.979] FindClose (in: hFindFile=0xa2a3e8 | out: hFindFile=0xa2a3e8) returned 1
	[0252.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7f8) returned 1
	[0252.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53ea58) returned 1
	[0253.005] CoTaskMemAlloc (cb=0x20c) returned 0xa9f898
	[0253.005] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa9f898 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0253.005] CoTaskMemFree (pv=0xa9f898) 
	[0253.005] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0253.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53eaa0) returned 1
	[0253.011] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\UCBrowser\\", nBufferLength=0x105, lpBuffer=0x53e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\UCBrowser\\", lpFilePart=0x0) returned 0x2b
	[0253.012] FindFirstFileW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\UCBrowser\\*", lpFindFileData=0x53e850 | out: lpFindFileData=0x53e850*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0253.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e810) returned 1
	[0253.061] CoTaskMemAlloc (cb=0x20c) returned 0xa9f898
	[0253.061] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa9f898 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0253.061] CoTaskMemFree (pv=0xa9f898) 
	[0253.061] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0253.073] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\falkon\\profiles\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e438, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\falkon\\profiles\\profiles.ini", lpFilePart=0x0) returned 0x3d
	[0253.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e950) returned 1
	[0253.074] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\falkon\\profiles\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\falkon\\profiles\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0253.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d770) returned 1
	[0253.207] CoTaskMemAlloc (cb=0x20c) returned 0xa9f898
	[0253.207] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa9f898 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0253.207] CoTaskMemFree (pv=0xa9f898) 
	[0253.207] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0253.215] CoTaskMemAlloc (cb=0x20c) returned 0xa9f898
	[0253.215] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa9f898 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0253.215] CoTaskMemFree (pv=0xa9f898) 
	[0253.215] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0253.224] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\eM Client", nBufferLength=0x105, lpBuffer=0x53e5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\eM Client", lpFilePart=0x0) returned 0x2c
	[0253.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7dc) returned 1
	[0253.224] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\eM Client" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\em client"), fInfoLevelId=0x0, lpFileInformation=0x53eaa0 | out: lpFileInformation=0x53eaa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7d8) returned 1
	[0253.395] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Wow6432Node\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.397] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Wow6432Node\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.399] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\RealVNC\\vncserver", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.400] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\RealVNC\\vncserver", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.401] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.402] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.403] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\ORL\\WinVNC3", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.404] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\ORL\\WinVNC3", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.404] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.405] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.406] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.407] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.408] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.409] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.410] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TigerVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.411] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TigerVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x53e9b4 | out: phkResult=0x53e9b4*=0x0) returned 0x2
	[0253.423] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x53e7d8, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0253.427] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x53e7d8, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0253.431] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x53e7d8, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0253.432] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x53e7d8, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0253.432] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x53e7d8, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0253.434] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x53e7d8, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0253.435] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x53e7d8, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0253.435] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x53e7d8, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0253.436] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x53e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36
	[0253.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e700) returned 1
	[0253.436] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x53e9c4 | out: lpFileInformation=0x53e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6fc) returned 1
	[0253.437] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x53e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36
	[0253.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e700) returned 1
	[0253.437] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x53e9c4 | out: lpFileInformation=0x53e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6fc) returned 1
	[0253.438] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x53e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36
	[0253.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e700) returned 1
	[0253.438] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x53e9c4 | out: lpFileInformation=0x53e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6fc) returned 1
	[0253.439] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x53e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36
	[0253.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e700) returned 1
	[0253.439] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x53e9c4 | out: lpFileInformation=0x53e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6fc) returned 1
	[0253.439] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x53e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c
	[0253.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e700) returned 1
	[0253.439] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x53e9c4 | out: lpFileInformation=0x53e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6fc) returned 1
	[0253.440] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x53e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c
	[0253.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e700) returned 1
	[0253.440] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x53e9c4 | out: lpFileInformation=0x53e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6fc) returned 1
	[0253.440] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x53e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c
	[0253.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e700) returned 1
	[0253.441] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x53e9c4 | out: lpFileInformation=0x53e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6fc) returned 1
	[0253.441] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x53e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c
	[0253.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e700) returned 1
	[0253.441] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x53e9c4 | out: lpFileInformation=0x53e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e6fc) returned 1
	[0253.480] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\K-Meleon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\K-Meleon\\profiles.ini", lpFilePart=0x0) returned 0x38
	[0253.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0253.480] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\K-Meleon\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\k-meleon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0253.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0253.491] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\K-Meleon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\K-Meleon\\profiles.ini", lpFilePart=0x0) returned 0x38
	[0253.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0253.491] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\K-Meleon\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\k-meleon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0253.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0253.682] CoTaskMemAlloc (cb=0x20c) returned 0xa620e8
	[0253.682] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa620e8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0253.682] CoTaskMemFree (pv=0xa620e8) 
	[0253.682] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0253.683] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\NordVPN", nBufferLength=0x105, lpBuffer=0x53e5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\NordVPN", lpFilePart=0x0) returned 0x28
	[0253.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e814) returned 1
	[0253.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\NordVPN" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\nordvpn"), fInfoLevelId=0x0, lpFileInformation=0x23197cc | out: lpFileInformation=0x23197cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e810) returned 1
	[0253.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0253.738] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x53e8b0, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0253.740] GetEnvironmentVariableW (in: lpName="Username", lpBuffer=0x53e8b0, nSize=0xd8 | out: lpBuffer="") returned 0x9
	[0253.748] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\AppData\\Roaming\\FlashFXP\\3quick.dat", nBufferLength=0x105, lpBuffer=0x53e5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\AppData\\Roaming\\FlashFXP\\3quick.dat", lpFilePart=0x0) returned 0x36
	[0253.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7ec) returned 1
	[0253.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\AppData\\Roaming\\FlashFXP\\3quick.dat" (normalized: "c:\\users\\all users\\appdata\\roaming\\flashfxp\\3quick.dat"), fInfoLevelId=0x0, lpFileInformation=0x53eab0 | out: lpFileInformation=0x53eab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7e8) returned 1
	[0253.789] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea90 | out: phkResult=0x53ea90*=0x0) returned 0x2
	[0253.823] CoTaskMemAlloc (cb=0x20c) returned 0xa620e8
	[0253.823] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa620e8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0253.823] CoTaskMemFree (pv=0xa620e8) 
	[0253.823] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e500, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0253.824] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat", nBufferLength=0x105, lpBuffer=0x53e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat", lpFilePart=0x0) returned 0x45
	[0253.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7d8) returned 1
	[0253.825] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\trillian\\users\\global\\accounts.dat"), fInfoLevelId=0x0, lpFileInformation=0x53ea9c | out: lpFileInformation=0x53ea9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7d4) returned 1
	[0253.834] CoTaskMemAlloc (cb=0x20c) returned 0xa620e8
	[0253.834] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa620e8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0253.834] CoTaskMemFree (pv=0xa620e8) 
	[0253.834] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e540, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0253.842] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Mailbird\\Store\\Store.db", nBufferLength=0x105, lpBuffer=0x53e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Mailbird\\Store\\Store.db", lpFilePart=0x0) returned 0x38
	[0253.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e818) returned 1
	[0253.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Mailbird\\Store\\Store.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\mailbird\\store\\store.db"), fInfoLevelId=0x0, lpFileInformation=0x53eadc | out: lpFileInformation=0x53eadc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e814) returned 1
	[0253.865] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x53e8a8, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0253.866] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\The Bat!", nBufferLength=0x105, lpBuffer=0x53e58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\The Bat!", lpFilePart=0x0) returned 0x2b
	[0253.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7c8) returned 1
	[0253.866] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\The Bat!" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\the bat!"), fInfoLevelId=0x0, lpFileInformation=0x53ea8c | out: lpFileInformation=0x53ea8c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7c4) returned 1
	[0253.884] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3b
	[0253.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0253.885] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0253.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0253.894] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3b
	[0253.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0253.895] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0253.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0253.915] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", lpFilePart=0x0) returned 0x4f
	[0253.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0253.915] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0253.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0253.929] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", lpFilePart=0x0) returned 0x4f
	[0253.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0253.930] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0253.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0253.948] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x3f
	[0253.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0253.948] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0253.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0253.956] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x3f
	[0253.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0253.957] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0253.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0253.996] CoTaskMemAlloc (cb=0x20c) returned 0xa620e8
	[0253.996] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa620e8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0253.996] CoTaskMemFree (pv=0xa620e8) 
	[0253.996] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0253.997] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat", nBufferLength=0x105, lpBuffer=0x53e5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat", lpFilePart=0x0) returned 0x4a
	[0253.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7f0) returned 1
	[0253.997] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mysql\\workbench\\workbench_user_data.dat"), fInfoLevelId=0x0, lpFileInformation=0x53eab4 | out: lpFileInformation=0x53eab4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0253.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7ec) returned 1
	[0254.059] GetEnvironmentVariableW (in: lpName="Programfiles(x86)", lpBuffer=0x53e870, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0254.060] GetEnvironmentVariableW (in: lpName="programfiles(x86)", lpBuffer=0x53e870, nSize=0xd8 | out: lpBuffer="") returned 0x16
	[0254.060] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\jDownloader\\config\\database.script", nBufferLength=0x105, lpBuffer=0x53e56c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\jDownloader\\config\\database.script", lpFilePart=0x0) returned 0x39
	[0254.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7ac) returned 1
	[0254.061] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\jDownloader\\config\\database.script" (normalized: "c:\\program files (x86)\\jdownloader\\config\\database.script"), fInfoLevelId=0x0, lpFileInformation=0x53ea70 | out: lpFileInformation=0x53ea70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0254.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7a8) returned 1
	[0254.095] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea54 | out: phkResult=0x53ea54*=0x0) returned 0x2
	[0254.096] GetFullPathNameW (in: lpFileName="Folder.lst", nBufferLength=0x105, lpBuffer=0x53e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\Folder.lst", lpFilePart=0x0) returned 0x25
	[0254.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7d8) returned 1
	[0254.096] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\Folder.lst" (normalized: "c:\\users\\keecfmwgj\\desktop\\folder.lst"), fInfoLevelId=0x0, lpFileInformation=0x53ea9c | out: lpFileInformation=0x53ea9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0254.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7d4) returned 1
	[0254.146] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\DownloadManager\\Passwords", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea80 | out: phkResult=0x53ea80*=0x0) returned 0x2
	[0254.208] CoTaskMemAlloc (cb=0x20c) returned 0xa620e8
	[0254.208] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa620e8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0254.209] CoTaskMemFree (pv=0xa620e8) 
	[0254.209] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0254.210] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FTPGetter\\servers.xml", nBufferLength=0x105, lpBuffer=0x53e5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FTPGetter\\servers.xml", lpFilePart=0x0) returned 0x38
	[0254.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7e8) returned 1
	[0254.210] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FTPGetter\\servers.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ftpgetter\\servers.xml"), fInfoLevelId=0x0, lpFileInformation=0x53eaac | out: lpFileInformation=0x53eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0254.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7e4) returned 1
	[0254.222] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\OpenVPN-GUI\\configs", ulOptions=0x0, samDesired=0x2001f, phkResult=0x53eaa0 | out: phkResult=0x53eaa0*=0x0) returned 0x2
	[0254.253] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x53e874, nSize=0xd8 | out: lpBuffer="") returned 0x22
	[0254.254] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini", nBufferLength=0x105, lpBuffer=0x53e560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini", lpFilePart=0x0) returned 0x43
	[0254.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7a0) returned 1
	[0254.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ipswitch\\ws_ftp\\sites\\ws_ftp.ini"), fInfoLevelId=0x0, lpFileInformation=0x53ea64 | out: lpFileInformation=0x53ea64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0254.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e79c) returned 1
	[0254.293] CoTaskMemAlloc (cb=0x20c) returned 0xa620e8
	[0254.294] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0xa620e8 | out: pszPath="C:\\Program Files (x86)") returned 0x0
	[0254.298] CoTaskMemFree (pv=0xa620e8) 
	[0254.298] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x53e528, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16
	[0254.301] CoTaskMemAlloc (cb=0x20c) returned 0xa620e8
	[0254.301] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xa620e8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0
	[0254.301] CoTaskMemFree (pv=0xa620e8) 
	[0254.301] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x53e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22
	[0254.321] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", nBufferLength=0x105, lpBuffer=0x53e590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", lpFilePart=0x0) returned 0x4e
	[0254.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e7d0) returned 1
	[0254.321] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe" (normalized: "c:\\program files (x86)\\common files\\apple\\apple application support\\plutil.exe"), fInfoLevelId=0x0, lpFileInformation=0x53ea94 | out: lpFileInformation=0x53ea94*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0254.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e7cc) returned 1
	[0254.351] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", lpFilePart=0x0) returned 0x4e
	[0254.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0254.352] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0254.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0254.365] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", lpFilePart=0x0) returned 0x4e
	[0254.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0254.366] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0254.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0254.394] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x41
	[0254.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0254.395] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0254.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0254.406] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x41
	[0254.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0254.406] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0254.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0254.494] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\IncrediMail\\Identities", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea7c | out: phkResult=0x53ea7c*=0x0) returned 0x2
	[0254.506] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Qualcomm\\Eudora\\CommandLine", ulOptions=0x0, samDesired=0x20019, phkResult=0x53ea6c | out: phkResult=0x53ea6c*=0x0) returned 0x2
	[0254.551] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", lpFilePart=0x0) returned 0x40
	[0254.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0254.551] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\comodo\\icedragon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0254.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0254.562] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x53e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", lpFilePart=0x0) returned 0x40
	[0254.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e96c) returned 1
	[0254.563] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\comodo\\icedragon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0254.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53d788) returned 1
	[0254.716] CoTaskMemAlloc (cb=0x20c) returned 0xa620e8
	[0254.716] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa620e8 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0
	[0254.716] CoTaskMemFree (pv=0xa620e8) 
	[0254.717] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x53e32c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20
	[0254.718] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x105, lpBuffer=0x53e3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Edge\\User Data", lpFilePart=0x0) returned 0x39
	[0254.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x53e5dc) returned 1
	[0254.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Edge\\User Data" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\edge\\user data"), fInfoLevelId=0x0, lpFileInformation=0x53e8a0 | out: lpFileInformation=0x53e8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0254.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x53e5d8) returned 1
	[0254.909] VaultEnumerateVaults () returned 0x0
	[0255.639] VaultOpenVault () returned 0x0
	[0255.661] VaultEnumerateItems () returned 0x0
	[0255.663] VaultOpenVault () returned 0x0
	[0255.663] VaultEnumerateItems () returned 0x0
	[0255.687] GetUserNameW (in: lpBuffer=0x53e8a0, pcbBuffer=0x23302f4 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x23302f4) returned 1
	[0255.688] GetComputerNameW (in: lpBuffer=0x53e8a0, nSize=0x23307a8 | out: lpBuffer="Q9IATRKPRH", nSize=0x23307a8) returned 1
	[0255.719] GetTimeZoneInformation (in: lpTimeZoneInformation=0x53e914 | out: lpTimeZoneInformation=0x53e914) returned 0x2
	[0255.860] GetUserNameW (in: lpBuffer=0x53e890, pcbBuffer=0x23342f4 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x23342f4) returned 1
	[0255.863] GetComputerNameW (in: lpBuffer=0x53e890, nSize=0x2334784 | out: lpBuffer="Q9IATRKPRH", nSize=0x2334784) returned 1
	[0255.868] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x41c
	[0255.868] SetEvent (hEvent=0x2c4) returned 1
	[0255.868] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53ea10*=0x41c, lpdwindex=0x53e834 | out: lpdwindex=0x53e834) returned 0x0
	[0255.874] CoGetContextToken (in: pToken=0x53e8e4 | out: pToken=0x53e8e4) returned 0x0
	[0255.874] CoGetContextToken (in: pToken=0x53e844 | out: pToken=0x53e844) returned 0x0
	[0255.874] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e280, riid=0x53e914*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53e910 | out: ppvObject=0x53e910*=0xa8e280) returned 0x0
	[0255.875] WbemDefPath:IUnknown:AddRef (This=0xa8e280) returned 0x3
	[0255.875] WbemDefPath:IUnknown:Release (This=0xa8e280) returned 0x2
	[0255.875] WbemDefPath:IWbemPath:SetText (This=0xa8e280, uMode=0x4, pszPath="Win32_OperatingSystem") returned 0x0
	[0255.875] WbemDefPath:IWbemPath:GetInfo (in: This=0xa8e280, uRequestedInfo=0x0, puResponse=0x53eabc | out: puResponse=0x53eabc*=0xc15) returned 0x0
	[0255.875] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa8e280, puCount=0x53eab4 | out: puCount=0x53eab4*=0x0) returned 0x0
	[0255.877] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ea8c | out: puCount=0x53ea8c*=0x2) returned 0x0
	[0255.877] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea88*=0x0, pszText=0x0 | out: puBuffLength=0x53ea88*=0xf, pszText=0x0) returned 0x0
	[0255.877] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea88*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ea88*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0255.900] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53e924*=0x430, lpdwindex=0x53e7dc | out: lpdwindex=0x53e7dc) returned 0x0
	[0255.942] CoGetContextToken (in: pToken=0x53e7dc | out: pToken=0x53e7dc) returned 0x0
	[0255.942] CoGetContextToken (in: pToken=0x53e73c | out: pToken=0x53e73c) returned 0x0
	[0255.942] CoGetContextToken (in: pToken=0x53e73c | out: pToken=0x53e73c) returned 0x0
	[0255.942] CoGetContextToken (in: pToken=0x53e6dc | out: pToken=0x53e6dc) returned 0x0
	[0255.942] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x72588ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e6b4 | out: ppvObject=0x53e6b4*=0x9f1eb0) returned 0x0
	[0255.942] CObjectContext::ContextCallback () returned 0x0
	[0255.951] IUnknown:Release (This=0x9f1eb0) returned 0x1
	[0255.951] CoUnmarshalInterface (in: pStm=0xa9c6e8, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53e730 | out: ppv=0x53e730*=0xa5b064) returned 0x0
	[0255.951] CoMarshalInterface (pStm=0xa9c6e8, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa5b064, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
	[0255.951] WbemLocator:IUnknown:QueryInterface (in: This=0xa5b064, riid=0x53e80c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x53e808 | out: ppvObject=0x53e808*=0x573e310) returned 0x0
	[0255.956] WbemLocator:IUnknown:Release (This=0xa5b064) returned 0x1
	[0255.956] IWbemServices:ExecQuery (in: This=0x573e310, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x53e9ec | out: ppEnum=0x53e9ec*=0x9ef7b8) returned 0x0
	[0255.961] IUnknown:QueryInterface (in: This=0x9ef7b8, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e83c | out: ppvObject=0x53e83c*=0x9ef7bc) returned 0x0
	[0255.961] IClientSecurity:QueryBlanket (in: This=0x9ef7bc, pProxy=0x9ef7b8, pAuthnSvc=0x53e88c, pAuthzSvc=0x53e888, pServerPrincName=0x53e880, pAuthnLevel=0x53e884, pImpLevel=0x53e874, pAuthInfo=0x53e878, pCapabilites=0x53e87c | out: pAuthnSvc=0x53e88c*=0xa, pAuthzSvc=0x53e888*=0x0, pServerPrincName=0x53e880, pAuthnLevel=0x53e884*=0x6, pImpLevel=0x53e874*=0x2, pAuthInfo=0x53e878, pCapabilites=0x53e87c*=0x1) returned 0x0
	[0255.961] IUnknown:Release (This=0x9ef7bc) returned 0x1
	[0255.961] IUnknown:QueryInterface (in: This=0x9ef7b8, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e830 | out: ppvObject=0x53e830*=0xa5b154) returned 0x0
	[0255.961] IUnknown:QueryInterface (in: This=0x9ef7b8, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e81c | out: ppvObject=0x53e81c*=0x9ef7bc) returned 0x0
	[0255.961] IClientSecurity:SetBlanket (This=0x9ef7bc, pProxy=0x9ef7b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0255.972] IUnknown:Release (This=0x9ef7bc) returned 0x2
	[0255.972] WbemLocator:IUnknown:Release (This=0xa5b154) returned 0x1
	[0255.972] CoTaskMemFree (pv=0x574dd70) 
	[0255.972] IUnknown:AddRef (This=0x9ef7b8) returned 0x2
	[0255.973] CoGetContextToken (in: pToken=0x53dd5c | out: pToken=0x53dd5c) returned 0x0
	[0255.973] CoGetContextToken (in: pToken=0x53e16c | out: pToken=0x53e16c) returned 0x0
	[0255.973] IUnknown:QueryInterface (in: This=0x9ef7b8, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e108 | out: ppvObject=0x53e108*=0xa5b13c) returned 0x0
	[0255.973] WbemLocator:IRpcOptions:Query (in: This=0xa5b13c, pPrx=0x574e4b0, dwProperty=2, pdwValue=0x53e1fc | out: pdwValue=0x53e1fc) returned 0x80004002
	[0255.973] WbemLocator:IUnknown:Release (This=0xa5b13c) returned 0x2
	[0255.973] CoGetContextToken (in: pToken=0x53e73c | out: pToken=0x53e73c) returned 0x0
	[0255.974] CoGetContextToken (in: pToken=0x53e69c | out: pToken=0x53e69c) returned 0x0
	[0255.974] IUnknown:QueryInterface (in: This=0x9ef7b8, riid=0x53e76c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x53e638 | out: ppvObject=0x53e638*=0x9ef7b8) returned 0x0
	[0255.974] IUnknown:Release (This=0x9ef7b8) returned 0x2
	[0255.974] WbemLocator:IUnknown:Release (This=0x573e310) returned 0x0
	[0255.974] SysStringLen (param_1=0x0) returned 0x0
	[0255.975] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ea38 | out: puCount=0x53ea38*=0x2) returned 0x0
	[0255.975] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea34*=0x0, pszText=0x0 | out: puBuffLength=0x53ea34*=0xf, pszText=0x0) returned 0x0
	[0255.975] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea34*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ea34*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0255.975] CoGetContextToken (in: pToken=0x53e87c | out: pToken=0x53e87c) returned 0x0
	[0255.976] IEnumWbemClassObject:Clone (in: This=0x9ef7b8, ppEnum=0x53ea34 | out: ppEnum=0x53ea34*=0x9ef880) returned 0x0
	[0255.977] IUnknown:QueryInterface (in: This=0x9ef880, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e8f0 | out: ppvObject=0x53e8f0*=0x9ef884) returned 0x0
	[0255.977] IClientSecurity:QueryBlanket (in: This=0x9ef884, pProxy=0x9ef880, pAuthnSvc=0x53e940, pAuthzSvc=0x53e93c, pServerPrincName=0x53e934, pAuthnLevel=0x53e938, pImpLevel=0x53e928, pAuthInfo=0x53e92c, pCapabilites=0x53e930 | out: pAuthnSvc=0x53e940*=0xa, pAuthzSvc=0x53e93c*=0x0, pServerPrincName=0x53e934, pAuthnLevel=0x53e938*=0x6, pImpLevel=0x53e928*=0x2, pAuthInfo=0x53e92c, pCapabilites=0x53e930*=0x1) returned 0x0
	[0255.977] IUnknown:Release (This=0x9ef884) returned 0x1
	[0255.977] IUnknown:QueryInterface (in: This=0x9ef880, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e8e4 | out: ppvObject=0x53e8e4*=0xa5b064) returned 0x0
	[0255.978] IUnknown:QueryInterface (in: This=0x9ef880, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e8d0 | out: ppvObject=0x53e8d0*=0x9ef884) returned 0x0
	[0255.978] IClientSecurity:SetBlanket (This=0x9ef884, pProxy=0x9ef880, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0255.980] IUnknown:Release (This=0x9ef884) returned 0x2
	[0255.980] WbemLocator:IUnknown:Release (This=0xa5b064) returned 0x1
	[0255.980] CoTaskMemFree (pv=0x574dd40) 
	[0255.980] IUnknown:AddRef (This=0x9ef880) returned 0x2
	[0255.981] CoGetContextToken (in: pToken=0x53de00 | out: pToken=0x53de00) returned 0x0
	[0255.981] CoGetContextToken (in: pToken=0x53e214 | out: pToken=0x53e214) returned 0x0
	[0255.981] IUnknown:QueryInterface (in: This=0x9ef880, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e1ac | out: ppvObject=0x53e1ac*=0xa5b04c) returned 0x0
	[0255.981] WbemLocator:IRpcOptions:Query (in: This=0xa5b04c, pPrx=0x574e528, dwProperty=2, pdwValue=0x53e2a0 | out: pdwValue=0x53e2a0) returned 0x80004002
	[0255.981] WbemLocator:IUnknown:Release (This=0xa5b04c) returned 0x2
	[0255.981] CoGetContextToken (in: pToken=0x53e7e4 | out: pToken=0x53e7e4) returned 0x0
	[0255.981] CoGetContextToken (in: pToken=0x53e744 | out: pToken=0x53e744) returned 0x0
	[0255.981] IUnknown:QueryInterface (in: This=0x9ef880, riid=0x53e814*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x53e6e0 | out: ppvObject=0x53e6e0*=0x9ef880) returned 0x0
	[0255.981] IUnknown:Release (This=0x9ef880) returned 0x2
	[0255.982] SysStringLen (param_1=0x0) returned 0x0
	[0255.982] IEnumWbemClassObject:Reset (This=0x9ef880) returned 0x0
	[0255.984] CoTaskMemAlloc (cb=0x4) returned 0xa91e00
	[0255.984] IEnumWbemClassObject:Next (in: This=0x9ef880, lTimeout=-1, uCount=0x1, apObjects=0xa91e00, puReturned=0x2335c9c | out: apObjects=0xa91e00*=0xa97be8, puReturned=0x2335c9c*=0x1) returned 0x0
	[0256.035] IUnknown:QueryInterface (in: This=0xa97be8, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e08c | out: ppvObject=0x53e08c*=0xa97be8) returned 0x0
	[0256.036] IUnknown:QueryInterface (in: This=0xa97be8, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e040 | out: ppvObject=0x53e040*=0x0) returned 0x80004002
	[0256.036] IUnknown:QueryInterface (in: This=0xa97be8, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53de68 | out: ppvObject=0x53de68*=0x0) returned 0x80004002
	[0256.036] IUnknown:AddRef (This=0xa97be8) returned 0x3
	[0256.037] IUnknown:QueryInterface (in: This=0xa97be8, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53d99c | out: ppvObject=0x53d99c*=0x0) returned 0x80004002
	[0256.037] IUnknown:QueryInterface (in: This=0xa97be8, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53d94c | out: ppvObject=0x53d94c*=0x0) returned 0x80004002
	[0256.037] IUnknown:QueryInterface (in: This=0xa97be8, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53d958 | out: ppvObject=0x53d958*=0xa97bec) returned 0x0
	[0256.037] IMarshal:GetUnmarshalClass (in: This=0xa97bec, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53d960 | out: pCid=0x53d960*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0256.037] IUnknown:Release (This=0xa97bec) returned 0x3
	[0256.037] CoGetContextToken (in: pToken=0x53d9b8 | out: pToken=0x53d9b8) returned 0x0
	[0256.037] CoGetContextToken (in: pToken=0x53ddcc | out: pToken=0x53ddcc) returned 0x0
	[0256.037] IUnknown:QueryInterface (in: This=0xa97be8, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de4c | out: ppvObject=0x53de4c*=0x0) returned 0x80004002
	[0256.038] IUnknown:Release (This=0xa97be8) returned 0x2
	[0256.038] CoGetContextToken (in: pToken=0x53e3b4 | out: pToken=0x53e3b4) returned 0x0
	[0256.038] CoGetContextToken (in: pToken=0x53e314 | out: pToken=0x53e314) returned 0x0
	[0256.038] IUnknown:QueryInterface (in: This=0xa97be8, riid=0x53e3e4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e3e0 | out: ppvObject=0x53e3e0*=0xa97be8) returned 0x0
	[0256.038] IUnknown:AddRef (This=0xa97be8) returned 0x4
	[0256.038] IUnknown:Release (This=0xa97be8) returned 0x3
	[0256.038] IUnknown:Release (This=0xa97be8) returned 0x2
	[0256.038] CoTaskMemFree (pv=0xa91e00) 
	[0256.039] CoGetContextToken (in: pToken=0x53e724 | out: pToken=0x53e724) returned 0x0
	[0256.039] IUnknown:AddRef (This=0xa97be8) returned 0x3
	[0256.039] CoTaskMemAlloc (cb=0x4) returned 0xa91e00
	[0256.039] IEnumWbemClassObject:Next (in: This=0x9ef880, lTimeout=-1, uCount=0x1, apObjects=0xa91e00, puReturned=0x2335c9c | out: apObjects=0xa91e00*=0x0, puReturned=0x2335c9c*=0x0) returned 0x1
	[0256.040] CoTaskMemFree (pv=0xa91e00) 
	[0256.040] CoGetContextToken (in: pToken=0x53e88c | out: pToken=0x53e88c) returned 0x0
	[0256.040] IEnumWbemClassObject:Clone (in: This=0x9ef7b8, ppEnum=0x53ea44 | out: ppEnum=0x53ea44*=0x9ef948) returned 0x0
	[0256.043] IUnknown:QueryInterface (in: This=0x9ef948, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e900 | out: ppvObject=0x53e900*=0x9ef94c) returned 0x0
	[0256.043] IClientSecurity:QueryBlanket (in: This=0x9ef94c, pProxy=0x9ef948, pAuthnSvc=0x53e950, pAuthzSvc=0x53e94c, pServerPrincName=0x53e944, pAuthnLevel=0x53e948, pImpLevel=0x53e938, pAuthInfo=0x53e93c, pCapabilites=0x53e940 | out: pAuthnSvc=0x53e950*=0xa, pAuthzSvc=0x53e94c*=0x0, pServerPrincName=0x53e944, pAuthnLevel=0x53e948*=0x6, pImpLevel=0x53e938*=0x2, pAuthInfo=0x53e93c, pCapabilites=0x53e940*=0x1) returned 0x0
	[0256.043] IUnknown:Release (This=0x9ef94c) returned 0x1
	[0256.043] IUnknown:QueryInterface (in: This=0x9ef948, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e8f4 | out: ppvObject=0x53e8f4*=0xa5b424) returned 0x0
	[0256.043] IUnknown:QueryInterface (in: This=0x9ef948, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e8e0 | out: ppvObject=0x53e8e0*=0x9ef94c) returned 0x0
	[0256.043] IClientSecurity:SetBlanket (This=0x9ef94c, pProxy=0x9ef948, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0256.045] IUnknown:Release (This=0x9ef94c) returned 0x2
	[0256.045] WbemLocator:IUnknown:Release (This=0xa5b424) returned 0x1
	[0256.045] CoTaskMemFree (pv=0x574ddd0) 
	[0256.046] IUnknown:AddRef (This=0x9ef948) returned 0x2
	[0256.046] CoGetContextToken (in: pToken=0x53de10 | out: pToken=0x53de10) returned 0x0
	[0256.047] CoGetContextToken (in: pToken=0x53e224 | out: pToken=0x53e224) returned 0x0
	[0256.047] IUnknown:QueryInterface (in: This=0x9ef948, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e1bc | out: ppvObject=0x53e1bc*=0xa5b40c) returned 0x0
	[0256.047] WbemLocator:IRpcOptions:Query (in: This=0xa5b40c, pPrx=0x574e5e8, dwProperty=2, pdwValue=0x53e2b0 | out: pdwValue=0x53e2b0) returned 0x80004002
	[0256.047] WbemLocator:IUnknown:Release (This=0xa5b40c) returned 0x2
	[0256.047] CoGetContextToken (in: pToken=0x53e7f4 | out: pToken=0x53e7f4) returned 0x0
	[0256.047] CoGetContextToken (in: pToken=0x53e754 | out: pToken=0x53e754) returned 0x0
	[0256.047] IUnknown:QueryInterface (in: This=0x9ef948, riid=0x53e824*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x53e6f0 | out: ppvObject=0x53e6f0*=0x9ef948) returned 0x0
	[0256.047] IUnknown:Release (This=0x9ef948) returned 0x2
	[0256.048] SysStringLen (param_1=0x0) returned 0x0
	[0256.048] IEnumWbemClassObject:Reset (This=0x9ef948) returned 0x0
	[0256.049] CoTaskMemAlloc (cb=0x4) returned 0xa21ea8
	[0256.049] IEnumWbemClassObject:Next (in: This=0x9ef948, lTimeout=-1, uCount=0x1, apObjects=0xa21ea8, puReturned=0x2335d80 | out: apObjects=0xa21ea8*=0xa97f18, puReturned=0x2335d80*=0x1) returned 0x0
	[0256.052] IUnknown:QueryInterface (in: This=0xa97f18, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e09c | out: ppvObject=0x53e09c*=0xa97f18) returned 0x0
	[0256.053] IUnknown:QueryInterface (in: This=0xa97f18, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e050 | out: ppvObject=0x53e050*=0x0) returned 0x80004002
	[0256.053] IUnknown:QueryInterface (in: This=0xa97f18, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53de78 | out: ppvObject=0x53de78*=0x0) returned 0x80004002
	[0256.053] IUnknown:AddRef (This=0xa97f18) returned 0x3
	[0256.053] IUnknown:QueryInterface (in: This=0xa97f18, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53d9ac | out: ppvObject=0x53d9ac*=0x0) returned 0x80004002
	[0256.053] IUnknown:QueryInterface (in: This=0xa97f18, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53d95c | out: ppvObject=0x53d95c*=0x0) returned 0x80004002
	[0256.053] IUnknown:QueryInterface (in: This=0xa97f18, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53d968 | out: ppvObject=0x53d968*=0xa97f1c) returned 0x0
	[0256.053] IMarshal:GetUnmarshalClass (in: This=0xa97f1c, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53d970 | out: pCid=0x53d970*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0256.054] IUnknown:Release (This=0xa97f1c) returned 0x3
	[0256.054] CoGetContextToken (in: pToken=0x53d9c8 | out: pToken=0x53d9c8) returned 0x0
	[0256.054] CoGetContextToken (in: pToken=0x53dddc | out: pToken=0x53dddc) returned 0x0
	[0256.054] IUnknown:QueryInterface (in: This=0xa97f18, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0256.054] IUnknown:Release (This=0xa97f18) returned 0x2
	[0256.054] CoGetContextToken (in: pToken=0x53e3c4 | out: pToken=0x53e3c4) returned 0x0
	[0256.054] CoGetContextToken (in: pToken=0x53e324 | out: pToken=0x53e324) returned 0x0
	[0256.054] IUnknown:QueryInterface (in: This=0xa97f18, riid=0x53e3f4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e3f0 | out: ppvObject=0x53e3f0*=0xa97f18) returned 0x0
	[0256.054] IUnknown:AddRef (This=0xa97f18) returned 0x4
	[0256.054] IUnknown:Release (This=0xa97f18) returned 0x3
	[0256.054] IUnknown:Release (This=0xa97f18) returned 0x2
	[0256.054] CoTaskMemFree (pv=0xa21ea8) 
	[0256.055] CoGetContextToken (in: pToken=0x53e734 | out: pToken=0x53e734) returned 0x0
	[0256.055] IUnknown:AddRef (This=0xa97f18) returned 0x3
	[0256.055] IWbemClassObject:Get (in: This=0xa97f18, wszName="__GENUS", lFlags=0, pVal=0x53ea34*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53eab4*=0, plFlavor=0x53eab0*=0 | out: pVal=0x53ea34*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53eab4*=3, plFlavor=0x53eab0*=64) returned 0x0
	[0256.056] IWbemClassObject:Get (in: This=0xa97f18, wszName="__PATH", lFlags=0, pVal=0x53ea18*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53ea9c*=0, plFlavor=0x53ea98*=0 | out: pVal=0x53ea18*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"Q9IATRKPRH\"", varVal2=0x0), pType=0x53ea9c*=8, plFlavor=0x53ea98*=64) returned 0x0
	[0256.056] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"Q9IATRKPRH\"") returned 0x82
	[0256.056] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"Q9IATRKPRH\"") returned 0x82
	[0256.057] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x46c
	[0256.057] SetEvent (hEvent=0x2c4) returned 1
	[0256.057] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53e9f0*=0x46c, lpdwindex=0x53e814 | out: lpdwindex=0x53e814) returned 0x0
	[0256.061] CoGetContextToken (in: pToken=0x53e8c4 | out: pToken=0x53e8c4) returned 0x0
	[0256.061] CoGetContextToken (in: pToken=0x53e824 | out: pToken=0x53e824) returned 0x0
	[0256.061] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e2f0, riid=0x53e8f4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53e8f0 | out: ppvObject=0x53e8f0*=0xa8e2f0) returned 0x0
	[0256.061] WbemDefPath:IUnknown:AddRef (This=0xa8e2f0) returned 0x3
	[0256.061] WbemDefPath:IUnknown:Release (This=0xa8e2f0) returned 0x2
	[0256.061] WbemDefPath:IWbemPath:SetText (This=0xa8e2f0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"Q9IATRKPRH\"") returned 0x0
	[0256.061] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ea70 | out: puCount=0x53ea70*=0x2) returned 0x0
	[0256.061] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea6c*=0x0, pszText=0x0 | out: puBuffLength=0x53ea6c*=0xf, pszText=0x0) returned 0x0
	[0256.061] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea6c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ea6c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0256.061] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ea64 | out: puCount=0x53ea64*=0x2) returned 0x0
	[0256.061] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea60*=0x0, pszText=0x0 | out: puBuffLength=0x53ea60*=0xf, pszText=0x0) returned 0x0
	[0256.061] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea60*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ea60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0256.061] IWbemClassObject:Get (in: This=0xa97f18, wszName="Name", lFlags=0, pVal=0x53ea60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23365f8*=0, plFlavor=0x23365fc*=0 | out: pVal=0x53ea60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x23365f8*=8, plFlavor=0x23365fc*=0) returned 0x0
	[0256.061] SysStringByteLen (bstr="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x92
	[0256.062] SysStringByteLen (bstr="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x92
	[0256.062] IWbemClassObject:Get (in: This=0xa97f18, wszName="Name", lFlags=0, pVal=0x53ea68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23365f8*=8, plFlavor=0x23365fc*=0 | out: pVal=0x53ea68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x23365f8*=8, plFlavor=0x23365fc*=0) returned 0x0
	[0256.062] SysStringByteLen (bstr="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x92
	[0256.062] SysStringByteLen (bstr="Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x92
	[0256.099] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ea7c | out: puCount=0x53ea7c*=0x2) returned 0x0
	[0256.099] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea78*=0x0, pszText=0x0 | out: puBuffLength=0x53ea78*=0xf, pszText=0x0) returned 0x0
	[0256.099] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea78*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ea78*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0256.123] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53e924*=0x480, lpdwindex=0x53e7dc | out: lpdwindex=0x53e7dc) returned 0x0
	[0256.140] CoGetContextToken (in: pToken=0x53e7e4 | out: pToken=0x53e7e4) returned 0x0
	[0256.141] CoGetContextToken (in: pToken=0x53e744 | out: pToken=0x53e744) returned 0x0
	[0256.141] CoGetContextToken (in: pToken=0x53e744 | out: pToken=0x53e744) returned 0x0
	[0256.141] CoGetContextToken (in: pToken=0x53e6e4 | out: pToken=0x53e6e4) returned 0x0
	[0256.141] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x72588ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e6bc | out: ppvObject=0x53e6bc*=0x9f1eb0) returned 0x0
	[0256.141] CObjectContext::ContextCallback () returned 0x0
	[0256.144] IUnknown:Release (This=0x9f1eb0) returned 0x1
	[0256.144] CoUnmarshalInterface (in: pStm=0xa9c848, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x53e738 | out: ppv=0x53e738*=0xa5b7e4) returned 0x0
	[0256.145] CoMarshalInterface (pStm=0xa9c848, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa5b7e4, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
	[0256.145] WbemLocator:IUnknown:QueryInterface (in: This=0xa5b7e4, riid=0x53e814*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x53e810 | out: ppvObject=0x53e810*=0x573e4a0) returned 0x0
	[0256.147] WbemLocator:IUnknown:Release (This=0xa5b7e4) returned 0x1
	[0256.147] IWbemServices:ExecQuery (in: This=0x573e4a0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x53e9ec | out: ppEnum=0x53e9ec*=0x9efad8) returned 0x0
	[0256.161] IUnknown:QueryInterface (in: This=0x9efad8, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e848 | out: ppvObject=0x53e848*=0x9efadc) returned 0x0
	[0256.161] IClientSecurity:QueryBlanket (in: This=0x9efadc, pProxy=0x9efad8, pAuthnSvc=0x53e898, pAuthzSvc=0x53e894, pServerPrincName=0x53e88c, pAuthnLevel=0x53e890, pImpLevel=0x53e880, pAuthInfo=0x53e884, pCapabilites=0x53e888 | out: pAuthnSvc=0x53e898*=0xa, pAuthzSvc=0x53e894*=0x0, pServerPrincName=0x53e88c, pAuthnLevel=0x53e890*=0x6, pImpLevel=0x53e880*=0x2, pAuthInfo=0x53e884, pCapabilites=0x53e888*=0x1) returned 0x0
	[0256.161] IUnknown:Release (This=0x9efadc) returned 0x1
	[0256.161] IUnknown:QueryInterface (in: This=0x9efad8, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e83c | out: ppvObject=0x53e83c*=0xa5b8d4) returned 0x0
	[0256.161] IUnknown:QueryInterface (in: This=0x9efad8, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e828 | out: ppvObject=0x53e828*=0x9efadc) returned 0x0
	[0256.162] IClientSecurity:SetBlanket (This=0x9efadc, pProxy=0x9efad8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0256.272] IUnknown:Release (This=0x9efadc) returned 0x2
	[0256.272] WbemLocator:IUnknown:Release (This=0xa5b8d4) returned 0x1
	[0256.272] CoTaskMemFree (pv=0x574def0) 
	[0256.272] IUnknown:AddRef (This=0x9efad8) returned 0x2
	[0256.273] CoGetContextToken (in: pToken=0x53dd68 | out: pToken=0x53dd68) returned 0x0
	[0256.273] CoGetContextToken (in: pToken=0x53e17c | out: pToken=0x53e17c) returned 0x0
	[0256.273] IUnknown:QueryInterface (in: This=0x9efad8, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e114 | out: ppvObject=0x53e114*=0xa5b8bc) returned 0x0
	[0256.273] WbemLocator:IRpcOptions:Query (in: This=0xa5b8bc, pPrx=0x574e888, dwProperty=2, pdwValue=0x53e208 | out: pdwValue=0x53e208) returned 0x80004002
	[0256.274] WbemLocator:IUnknown:Release (This=0xa5b8bc) returned 0x2
	[0256.274] CoGetContextToken (in: pToken=0x53e74c | out: pToken=0x53e74c) returned 0x0
	[0256.274] CoGetContextToken (in: pToken=0x53e6ac | out: pToken=0x53e6ac) returned 0x0
	[0256.274] IUnknown:QueryInterface (in: This=0x9efad8, riid=0x53e77c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x53e648 | out: ppvObject=0x53e648*=0x9efad8) returned 0x0
	[0256.274] IUnknown:Release (This=0x9efad8) returned 0x2
	[0256.274] WbemLocator:IUnknown:Release (This=0x573e4a0) returned 0x0
	[0256.275] SysStringLen (param_1=0x0) returned 0x0
	[0256.275] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ea38 | out: puCount=0x53ea38*=0x2) returned 0x0
	[0256.275] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea34*=0x0, pszText=0x0 | out: puBuffLength=0x53ea34*=0xf, pszText=0x0) returned 0x0
	[0256.275] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea34*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ea34*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0256.275] CoGetContextToken (in: pToken=0x53e88c | out: pToken=0x53e88c) returned 0x0
	[0256.276] IEnumWbemClassObject:Clone (in: This=0x9efad8, ppEnum=0x53ea44 | out: ppEnum=0x53ea44*=0x9efba0) returned 0x0
	[0256.281] IUnknown:QueryInterface (in: This=0x9efba0, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e900 | out: ppvObject=0x53e900*=0x9efba4) returned 0x0
	[0256.281] IClientSecurity:QueryBlanket (in: This=0x9efba4, pProxy=0x9efba0, pAuthnSvc=0x53e950, pAuthzSvc=0x53e94c, pServerPrincName=0x53e944, pAuthnLevel=0x53e948, pImpLevel=0x53e938, pAuthInfo=0x53e93c, pCapabilites=0x53e940 | out: pAuthnSvc=0x53e950*=0xa, pAuthzSvc=0x53e94c*=0x0, pServerPrincName=0x53e944, pAuthnLevel=0x53e948*=0x6, pImpLevel=0x53e938*=0x2, pAuthInfo=0x53e93c, pCapabilites=0x53e940*=0x1) returned 0x0
	[0256.282] IUnknown:Release (This=0x9efba4) returned 0x1
	[0256.282] IUnknown:QueryInterface (in: This=0x9efba0, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e8f4 | out: ppvObject=0x53e8f4*=0xa5b7e4) returned 0x0
	[0256.282] IUnknown:QueryInterface (in: This=0x9efba0, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e8e0 | out: ppvObject=0x53e8e0*=0x9efba4) returned 0x0
	[0256.282] IClientSecurity:SetBlanket (This=0x9efba4, pProxy=0x9efba0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0256.296] IUnknown:Release (This=0x9efba4) returned 0x2
	[0256.296] WbemLocator:IUnknown:Release (This=0xa5b7e4) returned 0x1
	[0256.296] CoTaskMemFree (pv=0x574de00) 
	[0256.296] IUnknown:AddRef (This=0x9efba0) returned 0x2
	[0256.297] CoGetContextToken (in: pToken=0x53de10 | out: pToken=0x53de10) returned 0x0
	[0256.297] CoGetContextToken (in: pToken=0x53e224 | out: pToken=0x53e224) returned 0x0
	[0256.297] IUnknown:QueryInterface (in: This=0x9efba0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e1bc | out: ppvObject=0x53e1bc*=0xa5b7cc) returned 0x0
	[0256.297] WbemLocator:IRpcOptions:Query (in: This=0xa5b7cc, pPrx=0x574e900, dwProperty=2, pdwValue=0x53e2b0 | out: pdwValue=0x53e2b0) returned 0x80004002
	[0256.297] WbemLocator:IUnknown:Release (This=0xa5b7cc) returned 0x2
	[0256.297] CoGetContextToken (in: pToken=0x53e7f4 | out: pToken=0x53e7f4) returned 0x0
	[0256.297] CoGetContextToken (in: pToken=0x53e754 | out: pToken=0x53e754) returned 0x0
	[0256.297] IUnknown:QueryInterface (in: This=0x9efba0, riid=0x53e824*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x53e6f0 | out: ppvObject=0x53e6f0*=0x9efba0) returned 0x0
	[0256.298] IUnknown:Release (This=0x9efba0) returned 0x2
	[0256.298] SysStringLen (param_1=0x0) returned 0x0
	[0256.298] IEnumWbemClassObject:Reset (This=0x9efba0) returned 0x0
	[0256.309] CoTaskMemAlloc (cb=0x4) returned 0x576a8e8
	[0256.309] IEnumWbemClassObject:Next (in: This=0x9efba0, lTimeout=-1, uCount=0x1, apObjects=0x576a8e8, puReturned=0x233731c | out: apObjects=0x576a8e8*=0xa98248, puReturned=0x233731c*=0x1) returned 0x0
	[0258.241] IUnknown:QueryInterface (in: This=0xa98248, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53e09c | out: ppvObject=0x53e09c*=0xa98248) returned 0x0
	[0258.242] IUnknown:QueryInterface (in: This=0xa98248, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x53e050 | out: ppvObject=0x53e050*=0x0) returned 0x80004002
	[0258.242] IUnknown:QueryInterface (in: This=0xa98248, riid=0x724d1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x53de78 | out: ppvObject=0x53de78*=0x0) returned 0x80004002
	[0258.243] IUnknown:AddRef (This=0xa98248) returned 0x3
	[0258.243] IUnknown:QueryInterface (in: This=0xa98248, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x53d9ac | out: ppvObject=0x53d9ac*=0x0) returned 0x80004002
	[0258.244] IUnknown:QueryInterface (in: This=0xa98248, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x53d95c | out: ppvObject=0x53d95c*=0x0) returned 0x80004002
	[0258.244] IUnknown:QueryInterface (in: This=0xa98248, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53d968 | out: ppvObject=0x53d968*=0xa9824c) returned 0x0
	[0258.244] IMarshal:GetUnmarshalClass (in: This=0xa9824c, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x53d970 | out: pCid=0x53d970*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0
	[0258.244] IUnknown:Release (This=0xa9824c) returned 0x3
	[0258.244] CoGetContextToken (in: pToken=0x53d9c8 | out: pToken=0x53d9c8) returned 0x0
	[0258.244] CoGetContextToken (in: pToken=0x53dddc | out: pToken=0x53dddc) returned 0x0
	[0258.245] IUnknown:QueryInterface (in: This=0xa98248, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53de5c | out: ppvObject=0x53de5c*=0x0) returned 0x80004002
	[0258.245] IUnknown:Release (This=0xa98248) returned 0x2
	[0258.245] CoGetContextToken (in: pToken=0x53e3c4 | out: pToken=0x53e3c4) returned 0x0
	[0258.245] CoGetContextToken (in: pToken=0x53e324 | out: pToken=0x53e324) returned 0x0
	[0258.245] IUnknown:QueryInterface (in: This=0xa98248, riid=0x53e3f4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x53e3f0 | out: ppvObject=0x53e3f0*=0xa98248) returned 0x0
	[0258.246] IUnknown:AddRef (This=0xa98248) returned 0x4
	[0258.246] IUnknown:Release (This=0xa98248) returned 0x3
	[0258.246] IUnknown:Release (This=0xa98248) returned 0x2
	[0258.246] CoTaskMemFree (pv=0x576a8e8) 
	[0258.246] CoGetContextToken (in: pToken=0x53e734 | out: pToken=0x53e734) returned 0x0
	[0258.247] IUnknown:AddRef (This=0xa98248) returned 0x3
	[0258.247] IWbemClassObject:Get (in: This=0xa98248, wszName="__GENUS", lFlags=0, pVal=0x53ea34*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53eab4*=0, plFlavor=0x53eab0*=0 | out: pVal=0x53ea34*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x53eab4*=3, plFlavor=0x53eab0*=64) returned 0x0
	[0258.248] IWbemClassObject:Get (in: This=0xa98248, wszName="__PATH", lFlags=0, pVal=0x53ea18*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x53ea9c*=0, plFlavor=0x53ea98*=0 | out: pVal=0x53ea18*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x53ea9c*=8, plFlavor=0x53ea98*=64) returned 0x0
	[0258.248] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x6e
	[0258.248] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x6e
	[0258.249] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x488
	[0258.249] SetEvent (hEvent=0x2c4) returned 1
	[0258.250] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x53e9f0*=0x488, lpdwindex=0x53e814 | out: lpdwindex=0x53e814) returned 0x0
	[0258.260] CoGetContextToken (in: pToken=0x53e8c4 | out: pToken=0x53e8c4) returned 0x0
	[0258.260] CoGetContextToken (in: pToken=0x53e824 | out: pToken=0x53e824) returned 0x0
	[0258.260] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e360, riid=0x53e8f4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x53e8f0 | out: ppvObject=0x53e8f0*=0xa8e360) returned 0x0
	[0258.260] WbemDefPath:IUnknown:AddRef (This=0xa8e360) returned 0x3
	[0258.260] WbemDefPath:IUnknown:Release (This=0xa8e360) returned 0x2
	[0258.260] WbemDefPath:IWbemPath:SetText (This=0xa8e360, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0
	[0258.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ea70 | out: puCount=0x53ea70*=0x2) returned 0x0
	[0258.261] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea6c*=0x0, pszText=0x0 | out: puBuffLength=0x53ea6c*=0xf, pszText=0x0) returned 0x0
	[0258.261] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea6c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ea6c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0258.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ea40 | out: puCount=0x53ea40*=0x2) returned 0x0
	[0258.261] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea3c*=0x0, pszText=0x0 | out: puBuffLength=0x53ea3c*=0xf, pszText=0x0) returned 0x0
	[0258.261] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ea3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0258.261] IWbemClassObject:Get (in: This=0xa98248, wszName="Name", lFlags=0, pVal=0x53ea3c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2337b74*=0, plFlavor=0x2337b78*=0 | out: pVal=0x53ea3c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x2337b74*=8, plFlavor=0x2337b78*=0) returned 0x0
	[0258.261] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e
	[0258.261] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e
	[0258.262] IWbemClassObject:Get (in: This=0xa98248, wszName="Name", lFlags=0, pVal=0x53ea44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2337b74*=8, plFlavor=0x2337b78*=0 | out: pVal=0x53ea44*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x2337b74*=8, plFlavor=0x2337b78*=0) returned 0x0
	[0258.262] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e
	[0258.262] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e
	[0258.262] CoTaskMemAlloc (cb=0x4) returned 0x576a938
	[0258.263] IEnumWbemClassObject:Next (in: This=0x9efba0, lTimeout=-1, uCount=0x1, apObjects=0x576a938, puReturned=0x233731c | out: apObjects=0x576a938*=0x0, puReturned=0x233731c*=0x0) returned 0x1
	[0258.265] CoTaskMemFree (pv=0x576a938) 
	[0258.265] CoGetContextToken (in: pToken=0x53e968 | out: pToken=0x53e968) returned 0x0
	[0258.265] IUnknown:Release (This=0x9efba0) returned 0x1
	[0258.266] IUnknown:Release (This=0x9efba0) returned 0x0
	[0258.279] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x53ea7c | out: puCount=0x53ea7c*=0x2) returned 0x0
	[0258.279] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea78*=0x0, pszText=0x0 | out: puBuffLength=0x53ea78*=0xf, pszText=0x0) returned 0x0
	[0258.279] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=4, puBuffLength=0x53ea78*=0xf, pszText="00000000000000" | out: puBuffLength=0x53ea78*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0258.285] GlobalMemoryStatusEx (in: lpBuffer=0x2337db0 | out: lpBuffer=0x2337db0) returned 1
	[0258.497] GetCurrentProcess () returned 0xffffffff
	[0258.497] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53e6ac | out: TokenHandle=0x53e6ac*=0x48c) returned 1
	[0258.508] CloseHandle (hObject=0x48c) returned 1
	[0258.508] GetCurrentProcess () returned 0xffffffff
	[0258.508] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53e6c4 | out: TokenHandle=0x53e6c4*=0x48c) returned 1
	[0258.509] CloseHandle (hObject=0x48c) returned 1
	[0259.027] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x53e9d8 | out: pFixedInfo=0x0, pOutBufLen=0x53e9d8) returned 0x6f
	[0259.663] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x574e9c8
	[0259.664] GetNetworkParams (in: pFixedInfo=0x574e9c8, pOutBufLen=0x53e9d8 | out: pFixedInfo=0x574e9c8, pOutBufLen=0x53e9d8) returned 0x0
	[0259.695] LocalFree (hMem=0x574e9c8) returned 0x0
	[0259.720] SystemFunction041 (in: Memory=0x5756bf4, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x5756bf4) returned 0x0
	[0259.728] SysStringLen (param_1="*VNHf^L9") returned 0x8
	[0259.728] SystemFunction040 (in: Memory=0xa482e4, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0xa482e4) returned 0x0
	[0259.776] GetCurrentProcess () returned 0xffffffff
	[0259.777] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53e5f4 | out: TokenHandle=0x53e5f4*=0x49c) returned 1
	[0259.779] CloseHandle (hObject=0x49c) returned 1
	[0259.779] GetCurrentProcess () returned 0xffffffff
	[0259.780] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53e60c | out: TokenHandle=0x53e60c*=0x49c) returned 1
	[0259.781] CloseHandle (hObject=0x49c) returned 1
	[0259.786] SetEvent (hEvent=0x238) returned 1
	[0259.816] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x53e718 | out: lpWSAData=0x53e718) returned 0
	[0259.827] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x4d8
	[0260.206] setsockopt (s=0x4d8, level=65535, optname=128, optval="\x01", optlen=4) returned -1
	[0260.207] closesocket (s=0x4d8) returned 0
	[0260.208] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x4d8
	[0260.289] setsockopt (s=0x4d8, level=65535, optname=128, optval="\x01", optlen=4) returned -1
	[0260.289] closesocket (s=0x4d8) returned 0
	[0260.297] GetCurrentProcess () returned 0xffffffff
	[0260.298] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53e518 | out: TokenHandle=0x53e518*=0x4d8) returned 1
	[0260.309] CloseHandle (hObject=0x4d8) returned 1
	[0260.309] GetCurrentProcess () returned 0xffffffff
	[0260.310] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x53e530 | out: TokenHandle=0x53e530*=0x4d8) returned 1
	[0260.311] CloseHandle (hObject=0x4d8) returned 1
	[0260.350] CreateSemaphoreA (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=1048576, lpName=0x0) returned 0x4d8
	[0260.351] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4dc
	[0260.358] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x4e0
	[0260.363] SetEvent (hEvent=0x238) returned 1
	[0260.365] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x186a0, cHandles=0x3, pHandles=0x53e850*=0x4d8, lpdwindex=0x53e714 | out: lpdwindex=0x53e714) returned 0x0
	[0260.373] ReleaseMutex (hMutex=0x4e0) returned 1
	[0260.378] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e4
	[0260.381] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e8
	[0260.388] GetAddrInfoW (in: pNodeName="smtp.zfftcn.com", pServiceName=0x0, pHints=0x53e7fc*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x53e7a4 | out: ppResult=0x53e7a4*=0x576b5a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="us2.smtp.mailhostbox.com", ai_addr=0x5769228*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.225"), ai_next=0x576b820*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769300*(sa_family=2, sin_port=0x0, sin_addr="208.91.198.143"), ai_next=0x576b848*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769318*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.223"), ai_next=0x576b870*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769330*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.224"), ai_next=0x0))))) returned 0
	[0260.862] FreeAddrInfoW (pAddrInfo=0x576b5a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="us2.smtp.mailhostbox.com", ai_addr=0x5769228*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.225"), ai_next=0x576b820*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769300*(sa_family=2, sin_port=0x0, sin_addr="208.91.198.143"), ai_next=0x576b848*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769318*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.223"), ai_next=0x576b870*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769330*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.224"), ai_next=0x0))))) 
	[0260.863] GetAddrInfoW (in: pNodeName="smtp.zfftcn.com", pServiceName=0x0, pHints=0x53e7fc*(ai_flags=131072, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x53e7a4 | out: ppResult=0x53e7a4*=0x576b870*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="smtp.zfftcn.com", ai_addr=0x5769330*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.225"), ai_next=0x576b820*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769318*(sa_family=2, sin_port=0x0, sin_addr="208.91.198.143"), ai_next=0x576b5a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769360*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.223"), ai_next=0x576b758*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769300*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.224"), ai_next=0x0))))) returned 0
	[0260.866] FreeAddrInfoW (pAddrInfo=0x576b870*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="smtp.zfftcn.com", ai_addr=0x5769330*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.225"), ai_next=0x576b820*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769318*(sa_family=2, sin_port=0x0, sin_addr="208.91.198.143"), ai_next=0x576b5a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769360*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.223"), ai_next=0x576b758*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5769300*(sa_family=2, sin_port=0x0, sin_addr="208.91.199.224"), ai_next=0x0))))) 
	[0260.867] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4f4
	[0260.868] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f8
	[0260.869] ioctlsocket (in: s=0x4f4, cmd=-2147195266, argp=0x53e7d4 | out: argp=0x53e7d4) returned 0
	[0260.869] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4fc
	[0260.869] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x500
	[0260.869] ioctlsocket (in: s=0x4fc, cmd=-2147195266, argp=0x53e7d4 | out: argp=0x53e7d4) returned 0
	[0260.871] WSAIoctl (in: s=0x4f4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x53e7bc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x53e7bc, lpOverlapped=0x0) returned -1
	[0260.872] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x53e4ec, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
	[0260.873] WSAEventSelect (s=0x4f4, hEventObject=0x4f8, lNetworkEvents=512) returned 0
	[0260.874] WSAIoctl (in: s=0x4fc, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x53e7bc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x53e7bc, lpOverlapped=0x0) returned -1
	[0260.874] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x53e4ec, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
	[0260.874] WSAEventSelect (s=0x4fc, hEventObject=0x500, lNetworkEvents=512) returned 0
	[0260.874] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x53e7b8*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x53e7b8*=0x7ec) returned 0x6f
	[0260.884] LocalAlloc (uFlags=0x0, uBytes=0x7ec) returned 0x5771eb0
	[0260.884] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x5771eb0, SizePointer=0x53e7b8*=0x7ec | out: AdapterAddresses=0x5771eb0*(Alignment=0xf00000178, Length=0x178, IfIndex=0xf, Next=0x577217c, AdapterName="{2E4C7576-F100-4C39-A70C-5E6D4E6BF9B7}", FirstUnicastAddress=0x57720f0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #4", FriendlyName="Local Area Connection 4", PhysicalAddress=([0]=0x0, [1]=0x40, [2]=0x43, [3]=0x80, [4]=0x76, [5]=0x5a, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0xf, ZoneIndices=([0]=0xf, [1]=0xf, [2]=0xf, [3]=0xf, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000009000000, Dhcpv4Server.lpSockaddr=0x5772028*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x27, [5]=0xbf, [6]=0xe, [7]=0x9e, [8]=0x0, [9]=0x26, [10]=0x67, [11]=0xd5, [12]=0xc6, [13]=0x31, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x12c89f1d, FirstDnsSuffix=0x0), SizePointer=0x53e7b8*=0x7ec) returned 0x0
	[0260.928] LocalFree (hMem=0x5771eb0) returned 0x0
	[0260.930] WSAConnect (in: s=0x4e4, name=0x2342d64*(sa_family=2, sin_port=0x24b, sin_addr="208.91.199.225"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0
	[0261.098] closesocket (s=0x4e8) returned 0
	[0261.099] setsockopt (s=0x4e4, level=6, optname=1, optval="\x01", optlen=4) returned 0
	[0261.105] recv (in: s=0x4e4, buf=0x2342e58, len=256, flags=0 | out: buf=0x2342e58*) returned 48
	[0261.282] send (s=0x4e4, buf=0x233ba90*, len=17, flags=0) returned 17
	[0261.283] recv (in: s=0x4e4, buf=0x2342e58, len=256, flags=0 | out: buf=0x2342e58*) returned 195
	[0261.471] send (s=0x4e4, buf=0x233ba90*, len=37, flags=0) returned 37
	[0261.471] recv (in: s=0x4e4, buf=0x2342e58, len=256, flags=0 | out: buf=0x2342e58*) returned 18
	[0261.644] SysStringLen (param_1="雭꜅ᗂꂐᤡﾡ") returned 0x8
	[0261.644] SystemFunction041 (in: Memory=0xa482e4, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0xa482e4) returned 0x0
	[0261.644] SysStringLen (param_1="*VNHf^L9") returned 0x8
	[0261.644] SystemFunction040 (in: Memory=0xa482e4, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0xa482e4) returned 0x0
	[0261.644] SysStringLen (param_1="*VNHf^L9") returned 0x8
	[0261.645] SysStringLen (param_1="*VNHf^L9") returned 0x8
	[0261.645] send (s=0x4e4, buf=0x233ba90*, len=14, flags=0) returned 14
	[0261.645] recv (in: s=0x4e4, buf=0x2342e58, len=256, flags=0 | out: buf=0x2342e58*) returned 37
	[0261.806] send (s=0x4e4, buf=0x233ba90*, len=30, flags=0) returned 30
	[0261.807] recv (in: s=0x4e4, buf=0x2342e58, len=256, flags=0 | out: buf=0x2342e58*) returned 14
	[0261.964] send (s=0x4e4, buf=0x233ba90*, len=28, flags=0) returned 28
	[0261.964] recv (in: s=0x4e4, buf=0x2342e58, len=256, flags=0 | out: buf=0x2342e58*) returned 14
	[0262.131] send (s=0x4e4, buf=0x233ba90*, len=6, flags=0) returned 6
	[0262.132] recv (in: s=0x4e4, buf=0x2342e58, len=256, flags=0 | out: buf=0x2342e58*) returned 37
	[0262.334] send (s=0x4e4, buf=0x2344f2c*, len=223, flags=0) returned 223
	[0262.337] send (s=0x4e4, buf=0x234b8d4*, len=360, flags=0) returned 360
	[0262.339] send (s=0x4e4, buf=0x2344f2c*, len=2, flags=0) returned 2
	[0262.339] send (s=0x4e4, buf=0x233ba90*, len=5, flags=0) returned 5
	[0262.339] recv (in: s=0x4e4, buf=0x2342e58, len=256, flags=0 | out: buf=0x2342e58*) returned 36
	[0262.598] ReleaseSemaphore (in: hSemaphore=0x4d8, lReleaseCount=1, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1
	[0262.617] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1be
	[0262.618] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc1bc
	[0262.620] GetSystemMetrics (nIndex=75) returned 1
	[0262.631] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0
	[0262.854] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772b0000
	[0262.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AddDllDirectory", cchWideChar=15, lpMultiByteStr=0x53ee24, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AddDllDirectory/¸gïmb\x9d\x1a Dþ<rÜñS", lpUsedDefaultChar=0x0) returned 15
	[0262.854] GetProcAddress (hModule=0x772b0000, lpProcName="AddDllDirectory") returned 0x773f1e91
	[0262.854] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x800) returned 0x6dc40000
	[0262.865] GetStockObject (i=5) returned 0x1900015
	[0262.866] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
	[0262.866] CoTaskMemAlloc (cb=0x5c) returned 0xa3bc20
	[0262.867] RegisterClassW (lpWndClass=0x53ed58) returned 0xc1c1
	[0262.867] CoTaskMemFree (pv=0xa3bc20) 
	[0262.868] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
	[0262.868] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.34f5582_r14_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x30328
	[0262.870] SetWindowLongW (hWnd=0x30328, nIndex=-4, dwNewLong=2005870045) returned 81007438
	[0262.870] GetWindowLongW (hWnd=0x30328, nIndex=-4) returned 2005870045
	[0262.870] SetWindowLongW (hWnd=0x30328, nIndex=-4, dwNewLong=81007478) returned 2005870045
	[0262.870] GetWindowLongW (hWnd=0x30328, nIndex=-4) returned 81007478
	[0262.870] GetWindowLongW (hWnd=0x30328, nIndex=-16) returned 113311744
	[0262.871] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc059
	[0262.871] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x30328, Msg=0x24, wParam=0x0, lParam=0x53e944) returned 0x0
	[0262.872] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x30328, Msg=0x81, wParam=0x0, lParam=0x53e938) returned 0x1
	[0262.872] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x30328, Msg=0x83, wParam=0x0, lParam=0x53e924) returned 0x0
	[0262.872] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x30328, Msg=0x1, wParam=0x0, lParam=0x53e938) returned 0x0
	[0262.873] GetClientRect (in: hWnd=0x30328, lpRect=0x53e6a0 | out: lpRect=0x53e6a0) returned 1
	[0262.873] GetWindowRect (in: hWnd=0x30328, lpRect=0x53e6a0 | out: lpRect=0x53e6a0) returned 1
	[0262.875] GetParent (hWnd=0x30328) returned 0x0
	[0262.877] OleInitialize (pvReserved=0x0) returned 0x0
	[0262.878] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x53ef88 | out: lplpMessageFilter=0x53ef88*=0x0) returned 0x0
	[0262.880] PeekMessageW (in: lpMsg=0x53ef5c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x53ef5c) returned 0
	[0262.880] PeekMessageW (in: lpMsg=0x53ef5c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x53ef5c) returned 0
	[0262.881] WaitMessage () 

Thread:
	id = 75
	os_tid = 0xaac


Thread:
	id = 76
	os_tid = 0xaa4

	[0146.845] CoGetContextToken (in: pToken=0x1f9f89c | out: pToken=0x1f9f89c) returned 0x800401f0
	[0146.845] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0

Thread:
	id = 77
	os_tid = 0xaa0


Thread:
	id = 86
	os_tid = 0xa78


Thread:
	id = 87
	os_tid = 0xa74


Thread:
	id = 88
	os_tid = 0xa70


Thread:
	id = 93
	os_tid = 0xad8

	[0160.767] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0160.818] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x545f4cc | out: lpiid=0x545f4cc) returned 0x0
	[0160.822] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa496d8) returned 0x0
	[0160.823] WbemDefPath:IUnknown:QueryInterface (in: This=0xa496d8, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0160.823] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa496d8, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa22400) returned 0x0
	[0160.823] WbemDefPath:IUnknown:Release (This=0xa496d8) returned 0x0
	[0160.823] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22400, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa22400) returned 0x0
	[0160.824] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22400, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0160.824] WbemDefPath:IUnknown:AddRef (This=0xa22400) returned 0x3
	[0160.824] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22400, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0160.825] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22400, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0160.825] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22400, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa496b8) returned 0x0
	[0160.825] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa496b8, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0160.825] WbemDefPath:IUnknown:Release (This=0xa496b8) returned 0x3
	[0160.825] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0160.827] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0160.827] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22400, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0160.827] WbemDefPath:IUnknown:Release (This=0xa22400) returned 0x2
	[0160.827] WbemDefPath:IUnknown:Release (This=0xa22400) returned 0x1
	[0160.828] SetEvent (hEvent=0x2c0) returned 1
	[0160.841] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa497f8) returned 0x0
	[0160.841] WbemDefPath:IUnknown:QueryInterface (in: This=0xa497f8, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0160.841] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa497f8, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa22470) returned 0x0
	[0160.841] WbemDefPath:IUnknown:Release (This=0xa497f8) returned 0x0
	[0160.841] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22470, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa22470) returned 0x0
	[0160.842] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22470, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0160.842] WbemDefPath:IUnknown:AddRef (This=0xa22470) returned 0x3
	[0160.842] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22470, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0160.842] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22470, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0160.842] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22470, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa49808) returned 0x0
	[0160.842] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa49808, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0160.842] WbemDefPath:IUnknown:Release (This=0xa49808) returned 0x3
	[0160.842] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0160.842] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0160.842] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22470, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0160.843] WbemDefPath:IUnknown:Release (This=0xa22470) returned 0x2
	[0160.843] WbemDefPath:IUnknown:Release (This=0xa22470) returned 0x1
	[0160.843] SetEvent (hEvent=0x2f4) returned 1
	[0160.846] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa49838) returned 0x0
	[0160.846] WbemDefPath:IUnknown:QueryInterface (in: This=0xa49838, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0160.846] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa49838, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa224e0) returned 0x0
	[0160.846] WbemDefPath:IUnknown:Release (This=0xa49838) returned 0x0
	[0160.846] WbemDefPath:IUnknown:QueryInterface (in: This=0xa224e0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa224e0) returned 0x0
	[0160.846] WbemDefPath:IUnknown:QueryInterface (in: This=0xa224e0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0160.847] WbemDefPath:IUnknown:AddRef (This=0xa224e0) returned 0x3
	[0160.847] WbemDefPath:IUnknown:QueryInterface (in: This=0xa224e0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0160.847] WbemDefPath:IUnknown:QueryInterface (in: This=0xa224e0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0160.847] WbemDefPath:IUnknown:QueryInterface (in: This=0xa224e0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa49848) returned 0x0
	[0160.847] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa49848, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0160.847] WbemDefPath:IUnknown:Release (This=0xa49848) returned 0x3
	[0160.847] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0160.847] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0160.847] WbemDefPath:IUnknown:QueryInterface (in: This=0xa224e0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0160.848] WbemDefPath:IUnknown:Release (This=0xa224e0) returned 0x2
	[0160.848] WbemDefPath:IUnknown:Release (This=0xa224e0) returned 0x1
	[0160.848] SetEvent (hEvent=0x2f8) returned 1
	[0163.227] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa498e8) returned 0x0
	[0163.228] WbemDefPath:IUnknown:QueryInterface (in: This=0xa498e8, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0163.228] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa498e8, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa22550) returned 0x0
	[0163.228] WbemDefPath:IUnknown:Release (This=0xa498e8) returned 0x0
	[0163.228] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22550, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa22550) returned 0x0
	[0163.228] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22550, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0163.228] WbemDefPath:IUnknown:AddRef (This=0xa22550) returned 0x3
	[0163.228] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22550, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0163.229] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22550, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0163.229] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22550, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa498f8) returned 0x0
	[0163.229] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa498f8, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0163.229] WbemDefPath:IUnknown:Release (This=0xa498f8) returned 0x3
	[0163.229] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0163.229] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0163.229] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22550, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0163.229] WbemDefPath:IUnknown:Release (This=0xa22550) returned 0x2
	[0163.229] WbemDefPath:IUnknown:Release (This=0xa22550) returned 0x1
	[0163.229] SetEvent (hEvent=0x34c) returned 1
	[0164.243] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa49988) returned 0x0
	[0164.244] WbemDefPath:IUnknown:QueryInterface (in: This=0xa49988, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0164.244] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa49988, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa22630) returned 0x0
	[0164.244] WbemDefPath:IUnknown:Release (This=0xa49988) returned 0x0
	[0164.244] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22630, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa22630) returned 0x0
	[0164.244] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22630, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0164.244] WbemDefPath:IUnknown:AddRef (This=0xa22630) returned 0x3
	[0164.244] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22630, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0164.244] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22630, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0164.244] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22630, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa49978) returned 0x0
	[0164.245] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa49978, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0164.245] WbemDefPath:IUnknown:Release (This=0xa49978) returned 0x3
	[0164.245] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0164.245] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0164.245] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22630, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0164.245] WbemDefPath:IUnknown:Release (This=0xa22630) returned 0x2
	[0164.245] WbemDefPath:IUnknown:Release (This=0xa22630) returned 0x1
	[0164.245] SetEvent (hEvent=0x354) returned 1
	[0164.354] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa49968) returned 0x0
	[0164.354] WbemDefPath:IUnknown:QueryInterface (in: This=0xa49968, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0164.354] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa49968, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa226a0) returned 0x0
	[0164.355] WbemDefPath:IUnknown:Release (This=0xa49968) returned 0x0
	[0164.355] WbemDefPath:IUnknown:QueryInterface (in: This=0xa226a0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa226a0) returned 0x0
	[0164.355] WbemDefPath:IUnknown:QueryInterface (in: This=0xa226a0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0164.355] WbemDefPath:IUnknown:AddRef (This=0xa226a0) returned 0x3
	[0164.355] WbemDefPath:IUnknown:QueryInterface (in: This=0xa226a0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0164.355] WbemDefPath:IUnknown:QueryInterface (in: This=0xa226a0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0164.355] WbemDefPath:IUnknown:QueryInterface (in: This=0xa226a0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa499a8) returned 0x0
	[0164.356] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa499a8, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0164.356] WbemDefPath:IUnknown:Release (This=0xa499a8) returned 0x3
	[0164.356] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0164.356] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0164.356] WbemDefPath:IUnknown:QueryInterface (in: This=0xa226a0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0164.356] WbemDefPath:IUnknown:Release (This=0xa226a0) returned 0x2
	[0164.356] WbemDefPath:IUnknown:Release (This=0xa226a0) returned 0x1
	[0164.356] SetEvent (hEvent=0x358) returned 1
	[0164.708] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76bb0) returned 0x0
	[0164.709] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76bb0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0164.709] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76bb0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa22710) returned 0x0
	[0164.709] WbemDefPath:IUnknown:Release (This=0xa76bb0) returned 0x0
	[0164.709] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22710, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa22710) returned 0x0
	[0164.709] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22710, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0164.710] WbemDefPath:IUnknown:AddRef (This=0xa22710) returned 0x3
	[0164.710] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22710, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0164.710] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22710, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0164.710] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22710, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76be0) returned 0x0
	[0164.711] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76be0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0164.711] WbemDefPath:IUnknown:Release (This=0xa76be0) returned 0x3
	[0164.711] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0164.711] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0164.711] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22710, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0164.711] WbemDefPath:IUnknown:Release (This=0xa22710) returned 0x2
	[0164.711] WbemDefPath:IUnknown:Release (This=0xa22710) returned 0x1
	[0164.711] SetEvent (hEvent=0x388) returned 1
	[0165.191] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76c60) returned 0x0
	[0165.191] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76c60, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.191] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76c60, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa22780) returned 0x0
	[0165.192] WbemDefPath:IUnknown:Release (This=0xa76c60) returned 0x0
	[0165.192] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22780, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa22780) returned 0x0
	[0165.192] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22780, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.192] WbemDefPath:IUnknown:AddRef (This=0xa22780) returned 0x3
	[0165.192] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22780, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.192] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22780, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.192] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22780, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76c70) returned 0x0
	[0165.192] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76c70, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.192] WbemDefPath:IUnknown:Release (This=0xa76c70) returned 0x3
	[0165.192] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.193] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.193] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22780, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.193] WbemDefPath:IUnknown:Release (This=0xa22780) returned 0x2
	[0165.193] WbemDefPath:IUnknown:Release (This=0xa22780) returned 0x1
	[0165.193] SetEvent (hEvent=0x38c) returned 1
	[0165.238] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76cb0) returned 0x0
	[0165.239] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76cb0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.239] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76cb0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa227f0) returned 0x0
	[0165.239] WbemDefPath:IUnknown:Release (This=0xa76cb0) returned 0x0
	[0165.239] WbemDefPath:IUnknown:QueryInterface (in: This=0xa227f0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa227f0) returned 0x0
	[0165.239] WbemDefPath:IUnknown:QueryInterface (in: This=0xa227f0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.240] WbemDefPath:IUnknown:AddRef (This=0xa227f0) returned 0x3
	[0165.240] WbemDefPath:IUnknown:QueryInterface (in: This=0xa227f0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.240] WbemDefPath:IUnknown:QueryInterface (in: This=0xa227f0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.240] WbemDefPath:IUnknown:QueryInterface (in: This=0xa227f0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76cc0) returned 0x0
	[0165.240] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76cc0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.240] WbemDefPath:IUnknown:Release (This=0xa76cc0) returned 0x3
	[0165.240] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.240] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.240] WbemDefPath:IUnknown:QueryInterface (in: This=0xa227f0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.240] WbemDefPath:IUnknown:Release (This=0xa227f0) returned 0x2
	[0165.240] WbemDefPath:IUnknown:Release (This=0xa227f0) returned 0x1
	[0165.240] SetEvent (hEvent=0x390) returned 1
	[0165.262] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76d00) returned 0x0
	[0165.262] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76d00, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.262] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76d00, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa22860) returned 0x0
	[0165.262] WbemDefPath:IUnknown:Release (This=0xa76d00) returned 0x0
	[0165.262] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22860, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa22860) returned 0x0
	[0165.262] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22860, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.263] WbemDefPath:IUnknown:AddRef (This=0xa22860) returned 0x3
	[0165.263] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22860, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.263] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22860, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.263] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22860, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76d10) returned 0x0
	[0165.263] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76d10, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.263] WbemDefPath:IUnknown:Release (This=0xa76d10) returned 0x3
	[0165.263] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.263] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.263] WbemDefPath:IUnknown:QueryInterface (in: This=0xa22860, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.263] WbemDefPath:IUnknown:Release (This=0xa22860) returned 0x2
	[0165.263] WbemDefPath:IUnknown:Release (This=0xa22860) returned 0x1
	[0165.263] SetEvent (hEvent=0x394) returned 1
	[0165.277] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76d50) returned 0x0
	[0165.277] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76d50, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.277] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76d50, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa228d0) returned 0x0
	[0165.277] WbemDefPath:IUnknown:Release (This=0xa76d50) returned 0x0
	[0165.277] WbemDefPath:IUnknown:QueryInterface (in: This=0xa228d0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa228d0) returned 0x0
	[0165.278] WbemDefPath:IUnknown:QueryInterface (in: This=0xa228d0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.278] WbemDefPath:IUnknown:AddRef (This=0xa228d0) returned 0x3
	[0165.278] WbemDefPath:IUnknown:QueryInterface (in: This=0xa228d0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.278] WbemDefPath:IUnknown:QueryInterface (in: This=0xa228d0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.278] WbemDefPath:IUnknown:QueryInterface (in: This=0xa228d0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76d60) returned 0x0
	[0165.278] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76d60, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.278] WbemDefPath:IUnknown:Release (This=0xa76d60) returned 0x3
	[0165.278] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.278] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.278] WbemDefPath:IUnknown:QueryInterface (in: This=0xa228d0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.278] WbemDefPath:IUnknown:Release (This=0xa228d0) returned 0x2
	[0165.278] WbemDefPath:IUnknown:Release (This=0xa228d0) returned 0x1
	[0165.278] SetEvent (hEvent=0x398) returned 1
	[0165.313] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76da0) returned 0x0
	[0165.314] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76da0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.314] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76da0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8ddb0) returned 0x0
	[0165.314] WbemDefPath:IUnknown:Release (This=0xa76da0) returned 0x0
	[0165.314] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8ddb0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8ddb0) returned 0x0
	[0165.314] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8ddb0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.314] WbemDefPath:IUnknown:AddRef (This=0xa8ddb0) returned 0x3
	[0165.314] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8ddb0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.314] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8ddb0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.315] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8ddb0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76db0) returned 0x0
	[0165.315] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76db0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.315] WbemDefPath:IUnknown:Release (This=0xa76db0) returned 0x3
	[0165.315] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.315] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.315] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8ddb0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.315] WbemDefPath:IUnknown:Release (This=0xa8ddb0) returned 0x2
	[0165.315] WbemDefPath:IUnknown:Release (This=0xa8ddb0) returned 0x1
	[0165.315] SetEvent (hEvent=0x39c) returned 1
	[0165.336] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76df0) returned 0x0
	[0165.336] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76df0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.336] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76df0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8de20) returned 0x0
	[0165.337] WbemDefPath:IUnknown:Release (This=0xa76df0) returned 0x0
	[0165.337] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de20, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8de20) returned 0x0
	[0165.337] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de20, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.338] WbemDefPath:IUnknown:AddRef (This=0xa8de20) returned 0x3
	[0165.338] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de20, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.338] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de20, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.338] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de20, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76e00) returned 0x0
	[0165.338] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76e00, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.338] WbemDefPath:IUnknown:Release (This=0xa76e00) returned 0x3
	[0165.338] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.338] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.338] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de20, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.339] WbemDefPath:IUnknown:Release (This=0xa8de20) returned 0x2
	[0165.339] WbemDefPath:IUnknown:Release (This=0xa8de20) returned 0x1
	[0165.339] SetEvent (hEvent=0x3a0) returned 1
	[0165.368] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76e40) returned 0x0
	[0165.369] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76e40, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.369] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76e40, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8de90) returned 0x0
	[0165.369] WbemDefPath:IUnknown:Release (This=0xa76e40) returned 0x0
	[0165.369] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de90, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8de90) returned 0x0
	[0165.369] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de90, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.370] WbemDefPath:IUnknown:AddRef (This=0xa8de90) returned 0x3
	[0165.370] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de90, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.370] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de90, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.370] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de90, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76e50) returned 0x0
	[0165.370] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76e50, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.370] WbemDefPath:IUnknown:Release (This=0xa76e50) returned 0x3
	[0165.370] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.370] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.370] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8de90, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.370] WbemDefPath:IUnknown:Release (This=0xa8de90) returned 0x2
	[0165.370] WbemDefPath:IUnknown:Release (This=0xa8de90) returned 0x1
	[0165.370] SetEvent (hEvent=0x3a4) returned 1
	[0165.388] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76e90) returned 0x0
	[0165.389] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76e90, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.389] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76e90, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8df00) returned 0x0
	[0165.389] WbemDefPath:IUnknown:Release (This=0xa76e90) returned 0x0
	[0165.389] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df00, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8df00) returned 0x0
	[0165.389] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df00, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.390] WbemDefPath:IUnknown:AddRef (This=0xa8df00) returned 0x3
	[0165.390] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df00, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.390] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df00, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.390] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df00, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76ea0) returned 0x0
	[0165.390] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76ea0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.390] WbemDefPath:IUnknown:Release (This=0xa76ea0) returned 0x3
	[0165.390] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.390] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.390] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df00, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.391] WbemDefPath:IUnknown:Release (This=0xa8df00) returned 0x2
	[0165.391] WbemDefPath:IUnknown:Release (This=0xa8df00) returned 0x1
	[0165.391] SetEvent (hEvent=0x3a8) returned 1
	[0165.418] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76ee0) returned 0x0
	[0165.419] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76ee0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.419] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76ee0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8df70) returned 0x0
	[0165.419] WbemDefPath:IUnknown:Release (This=0xa76ee0) returned 0x0
	[0165.419] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df70, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8df70) returned 0x0
	[0165.419] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df70, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.420] WbemDefPath:IUnknown:AddRef (This=0xa8df70) returned 0x3
	[0165.420] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df70, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.420] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df70, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.420] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df70, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76ef0) returned 0x0
	[0165.420] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76ef0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.420] WbemDefPath:IUnknown:Release (This=0xa76ef0) returned 0x3
	[0165.420] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.420] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.420] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8df70, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.420] WbemDefPath:IUnknown:Release (This=0xa8df70) returned 0x2
	[0165.421] WbemDefPath:IUnknown:Release (This=0xa8df70) returned 0x1
	[0165.421] SetEvent (hEvent=0x3ac) returned 1
	[0165.447] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76f30) returned 0x0
	[0165.447] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76f30, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.447] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76f30, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8dfe0) returned 0x0
	[0165.447] WbemDefPath:IUnknown:Release (This=0xa76f30) returned 0x0
	[0165.447] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8dfe0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8dfe0) returned 0x0
	[0165.447] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8dfe0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.448] WbemDefPath:IUnknown:AddRef (This=0xa8dfe0) returned 0x3
	[0165.448] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8dfe0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.448] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8dfe0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.448] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8dfe0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa76f40) returned 0x0
	[0165.448] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa76f40, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.448] WbemDefPath:IUnknown:Release (This=0xa76f40) returned 0x3
	[0165.448] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.448] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.448] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8dfe0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.449] WbemDefPath:IUnknown:Release (This=0xa8dfe0) returned 0x2
	[0165.449] WbemDefPath:IUnknown:Release (This=0xa8dfe0) returned 0x1
	[0165.449] SetEvent (hEvent=0x3b0) returned 1
	[0165.459] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa76f80) returned 0x0
	[0165.459] WbemDefPath:IUnknown:QueryInterface (in: This=0xa76f80, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.460] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa76f80, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8e050) returned 0x0
	[0165.460] WbemDefPath:IUnknown:Release (This=0xa76f80) returned 0x0
	[0165.460] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e050, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8e050) returned 0x0
	[0165.460] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e050, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.460] WbemDefPath:IUnknown:AddRef (This=0xa8e050) returned 0x3
	[0165.460] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e050, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.460] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e050, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.460] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e050, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa91a90) returned 0x0
	[0165.460] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa91a90, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.460] WbemDefPath:IUnknown:Release (This=0xa91a90) returned 0x3
	[0165.461] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.461] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.461] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e050, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.461] WbemDefPath:IUnknown:Release (This=0xa8e050) returned 0x2
	[0165.461] WbemDefPath:IUnknown:Release (This=0xa8e050) returned 0x1
	[0165.461] SetEvent (hEvent=0x3b4) returned 1
	[0165.470] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa91ad0) returned 0x0
	[0165.471] WbemDefPath:IUnknown:QueryInterface (in: This=0xa91ad0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.471] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa91ad0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8e0c0) returned 0x0
	[0165.471] WbemDefPath:IUnknown:Release (This=0xa91ad0) returned 0x0
	[0165.471] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e0c0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8e0c0) returned 0x0
	[0165.471] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e0c0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.471] WbemDefPath:IUnknown:AddRef (This=0xa8e0c0) returned 0x3
	[0165.472] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e0c0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.472] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e0c0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.472] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e0c0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa91ae0) returned 0x0
	[0165.472] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa91ae0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.472] WbemDefPath:IUnknown:Release (This=0xa91ae0) returned 0x3
	[0165.472] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.472] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.472] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e0c0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.472] WbemDefPath:IUnknown:Release (This=0xa8e0c0) returned 0x2
	[0165.472] WbemDefPath:IUnknown:Release (This=0xa8e0c0) returned 0x1
	[0165.472] SetEvent (hEvent=0x3b8) returned 1
	[0165.482] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa91b20) returned 0x0
	[0165.483] WbemDefPath:IUnknown:QueryInterface (in: This=0xa91b20, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.483] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa91b20, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8e130) returned 0x0
	[0165.483] WbemDefPath:IUnknown:Release (This=0xa91b20) returned 0x0
	[0165.483] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e130, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8e130) returned 0x0
	[0165.483] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e130, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.483] WbemDefPath:IUnknown:AddRef (This=0xa8e130) returned 0x3
	[0165.483] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e130, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.483] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e130, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.483] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e130, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa91b30) returned 0x0
	[0165.483] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa91b30, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.483] WbemDefPath:IUnknown:Release (This=0xa91b30) returned 0x3
	[0165.483] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.484] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.484] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e130, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.484] WbemDefPath:IUnknown:Release (This=0xa8e130) returned 0x2
	[0165.484] WbemDefPath:IUnknown:Release (This=0xa8e130) returned 0x1
	[0165.484] SetEvent (hEvent=0x3bc) returned 1
	[0165.493] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa91b70) returned 0x0
	[0165.493] WbemDefPath:IUnknown:QueryInterface (in: This=0xa91b70, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0165.493] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa91b70, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8e1a0) returned 0x0
	[0165.493] WbemDefPath:IUnknown:Release (This=0xa91b70) returned 0x0
	[0165.493] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e1a0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8e1a0) returned 0x0
	[0165.493] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e1a0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0165.494] WbemDefPath:IUnknown:AddRef (This=0xa8e1a0) returned 0x3
	[0165.494] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e1a0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0165.494] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e1a0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0165.494] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e1a0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa91b80) returned 0x0
	[0165.494] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa91b80, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0165.494] WbemDefPath:IUnknown:Release (This=0xa91b80) returned 0x3
	[0165.494] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0165.494] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0165.494] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e1a0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0165.494] WbemDefPath:IUnknown:Release (This=0xa8e1a0) returned 0x2
	[0165.494] WbemDefPath:IUnknown:Release (This=0xa8e1a0) returned 0x1
	[0165.494] SetEvent (hEvent=0x3c0) returned 1
	[0255.871] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa91d40) returned 0x0
	[0255.872] WbemDefPath:IUnknown:QueryInterface (in: This=0xa91d40, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0255.872] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa91d40, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8e280) returned 0x0
	[0255.872] WbemDefPath:IUnknown:Release (This=0xa91d40) returned 0x0
	[0255.872] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e280, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8e280) returned 0x0
	[0255.873] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e280, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0255.873] WbemDefPath:IUnknown:AddRef (This=0xa8e280) returned 0x3
	[0255.873] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e280, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0255.873] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e280, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0255.873] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e280, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa91c20) returned 0x0
	[0255.873] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa91c20, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0255.873] WbemDefPath:IUnknown:Release (This=0xa91c20) returned 0x3
	[0255.873] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0255.874] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0255.874] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e280, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0255.874] WbemDefPath:IUnknown:Release (This=0xa8e280) returned 0x2
	[0255.874] WbemDefPath:IUnknown:Release (This=0xa8e280) returned 0x1
	[0255.874] SetEvent (hEvent=0x41c) returned 1
	[0256.059] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0xa21ea8) returned 0x0
	[0256.059] WbemDefPath:IUnknown:QueryInterface (in: This=0xa21ea8, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0256.059] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa21ea8, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8e2f0) returned 0x0
	[0256.059] WbemDefPath:IUnknown:Release (This=0xa21ea8) returned 0x0
	[0256.059] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e2f0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8e2f0) returned 0x0
	[0256.059] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e2f0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0256.060] WbemDefPath:IUnknown:AddRef (This=0xa8e2f0) returned 0x3
	[0256.060] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e2f0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0256.060] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e2f0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0256.060] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e2f0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0xa91e30) returned 0x0
	[0256.060] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa91e30, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0256.060] WbemDefPath:IUnknown:Release (This=0xa91e30) returned 0x3
	[0256.060] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0256.060] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0256.060] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e2f0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0256.060] WbemDefPath:IUnknown:Release (This=0xa8e2f0) returned 0x2
	[0256.060] WbemDefPath:IUnknown:Release (This=0xa8e2f0) returned 0x1
	[0256.060] SetEvent (hEvent=0x46c) returned 1
	[0258.255] CoGetClassObject (in: rclsid=0xa53384*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f1e8 | out: ppv=0x545f1e8*=0x576a8e8) returned 0x0
	[0258.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x576a8e8, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f400 | out: ppvObject=0x545f400*=0x0) returned 0x80004002
	[0258.256] WbemDefPath:IClassFactory:CreateInstance (in: This=0x576a8e8, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f40c | out: ppvObject=0x545f40c*=0xa8e360) returned 0x0
	[0258.256] WbemDefPath:IUnknown:Release (This=0x576a8e8) returned 0x0
	[0258.256] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e360, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f02c | out: ppvObject=0x545f02c*=0xa8e360) returned 0x0
	[0258.257] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e360, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545efe0 | out: ppvObject=0x545efe0*=0x0) returned 0x80004002
	[0258.257] WbemDefPath:IUnknown:AddRef (This=0xa8e360) returned 0x3
	[0258.258] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e360, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e93c | out: ppvObject=0x545e93c*=0x0) returned 0x80004002
	[0258.258] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e360, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e8ec | out: ppvObject=0x545e8ec*=0x0) returned 0x80004002
	[0258.258] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e360, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e8f8 | out: ppvObject=0x545e8f8*=0x576a908) returned 0x0
	[0258.258] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x576a908, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e900 | out: pCid=0x545e900*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
	[0258.258] WbemDefPath:IUnknown:Release (This=0x576a908) returned 0x3
	[0258.258] CoGetContextToken (in: pToken=0x545e958 | out: pToken=0x545e958) returned 0x0
	[0258.259] CoGetContextToken (in: pToken=0x545ed6c | out: pToken=0x545ed6c) returned 0x0
	[0258.259] WbemDefPath:IUnknown:QueryInterface (in: This=0xa8e360, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545edec | out: ppvObject=0x545edec*=0x0) returned 0x80004002
	[0258.259] WbemDefPath:IUnknown:Release (This=0xa8e360) returned 0x2
	[0258.259] WbemDefPath:IUnknown:Release (This=0xa8e360) returned 0x1
	[0258.259] SetEvent (hEvent=0x488) returned 1

Thread:
	id = 94
	os_tid = 0xa7c

	[0160.860] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0160.861] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x571f7f4 | out: lpiid=0x571f7f4) returned 0x0
	[0160.862] CoGetClassObject (in: rclsid=0xa53414*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x571f510 | out: ppv=0x571f510*=0xa5d1b0) returned 0x0
	[0160.863] WbemLocator:IUnknown:QueryInterface (in: This=0xa5d1b0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x571f728 | out: ppvObject=0x571f728*=0x0) returned 0x80004002
	[0160.863] WbemLocator:IClassFactory:CreateInstance (in: This=0xa5d1b0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x571f734 | out: ppvObject=0x571f734*=0xa49878) returned 0x0
	[0160.863] WbemLocator:IUnknown:Release (This=0xa5d1b0) returned 0x0
	[0160.863] WbemLocator:IUnknown:QueryInterface (in: This=0xa49878, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x571f354 | out: ppvObject=0x571f354*=0xa49878) returned 0x0
	[0160.863] WbemLocator:IUnknown:QueryInterface (in: This=0xa49878, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x571f308 | out: ppvObject=0x571f308*=0x0) returned 0x80004002
	[0160.863] WbemLocator:IUnknown:AddRef (This=0xa49878) returned 0x3
	[0160.864] WbemLocator:IUnknown:QueryInterface (in: This=0xa49878, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x571ec64 | out: ppvObject=0x571ec64*=0x0) returned 0x80004002
	[0160.864] WbemLocator:IUnknown:QueryInterface (in: This=0xa49878, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x571ec14 | out: ppvObject=0x571ec14*=0x0) returned 0x80004002
	[0160.864] WbemLocator:IUnknown:QueryInterface (in: This=0xa49878, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x571ec20 | out: ppvObject=0x571ec20*=0x0) returned 0x80004002
	[0160.864] CoGetContextToken (in: pToken=0x571ec80 | out: pToken=0x571ec80) returned 0x0
	[0160.864] CoGetObjectContext (in: riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xa5d1b4 | out: ppv=0xa5d1b4*=0x9f1ea0) returned 0x0
	[0160.867] CoGetContextToken (in: pToken=0x571f094 | out: pToken=0x571f094) returned 0x0
	[0160.867] WbemLocator:IUnknown:QueryInterface (in: This=0xa49878, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x571f114 | out: ppvObject=0x571f114*=0x0) returned 0x80004002
	[0160.868] WbemLocator:IUnknown:Release (This=0xa49878) returned 0x2
	[0160.868] WbemLocator:IUnknown:Release (This=0xa49878) returned 0x1
	[0160.868] CoGetContextToken (in: pToken=0x571f70c | out: pToken=0x571f70c) returned 0x0
	[0160.868] CoGetContextToken (in: pToken=0x571f66c | out: pToken=0x571f66c) returned 0x0
	[0160.868] WbemLocator:IUnknown:QueryInterface (in: This=0xa49878, riid=0x571f73c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x571f738 | out: ppvObject=0x571f738*=0xa49878) returned 0x0
	[0160.868] WbemLocator:IUnknown:AddRef (This=0xa49878) returned 0x3
	[0160.868] WbemLocator:IUnknown:Release (This=0xa49878) returned 0x2
	[0160.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa224e0, puCount=0x571f8cc | out: puCount=0x571f8cc*=0x2) returned 0x0
	[0160.874] WbemDefPath:IWbemPath:GetText (in: This=0xa224e0, lFlags=8, puBuffLength=0x571f8c8*=0x0, pszText=0x0 | out: puBuffLength=0x571f8c8*=0xf, pszText=0x0) returned 0x0
	[0160.874] WbemDefPath:IWbemPath:GetText (in: This=0xa224e0, lFlags=8, puBuffLength=0x571f8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x571f8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0160.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x571eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
	[0160.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x571f018, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63
	[0160.889] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6cf20000
	[0160.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x571f04c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecuritymaob\x9d\x1a Dþ<r(óq\x05\x01", lpUsedDefaultChar=0x0) returned 13
	[0160.895] GetProcAddress (hModule=0x6cf20000, lpProcName="ResetSecurity") returned 0x6cf27dd0
	[0160.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x571f04c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11
	[0160.917] GetProcAddress (hModule=0x6cf20000, lpProcName="SetSecurity") returned 0x6cf27e20
	[0160.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x571f048, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 18
	[0160.938] GetProcAddress (hModule=0x6cf20000, lpProcName="BlessIWbemServices") returned 0x6cf26e70
	[0160.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x571f040, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 24
	[0160.982] GetProcAddress (hModule=0x6cf20000, lpProcName="BlessIWbemServicesObject") returned 0x6cf26ed0
	[0161.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x571f048, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandlemaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 17
	[0161.072] GetProcAddress (hModule=0x6cf20000, lpProcName="GetPropertyHandle") returned 0x6cf27820
	[0161.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x571f048, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 18
	[0161.102] GetProcAddress (hModule=0x6cf20000, lpProcName="WritePropertyValue") returned 0x6cf27fa0
	[0161.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x571f054, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonemaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 5
	[0161.121] GetProcAddress (hModule=0x6cf20000, lpProcName="Clone") returned 0x6cf26f30
	[0161.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x571f048, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15
	[0161.146] GetProcAddress (hModule=0x6cf20000, lpProcName="VerifyClientKey") returned 0x6cf27f20
	[0161.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x571f048, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15
	[0161.158] GetProcAddress (hModule=0x6cf20000, lpProcName="GetQualifierSet") returned 0x6cf278e0
	[0161.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x571f054, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3
	[0161.162] GetProcAddress (hModule=0x6cf20000, lpProcName="Get") returned 0x6cf275c0
	[0161.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x571f054, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3
	[0161.203] GetProcAddress (hModule=0x6cf20000, lpProcName="Put") returned 0x6cf27a00
	[0161.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x571f054, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleteaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 6
	[0161.234] GetProcAddress (hModule=0x6cf20000, lpProcName="Delete") returned 0x6cf27300
	[0161.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x571f050, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 8
	[0161.251] GetProcAddress (hModule=0x6cf20000, lpProcName="GetNames") returned 0x6cf277c0
	[0161.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x571f048, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 16
	[0161.324] GetProcAddress (hModule=0x6cf20000, lpProcName="BeginEnumeration") returned 0x6cf26e30
	[0161.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x571f054, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 4
	[0161.340] GetProcAddress (hModule=0x6cf20000, lpProcName="Next") returned 0x6cf279a0
	[0161.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x571f04c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 14
	[0161.373] GetProcAddress (hModule=0x6cf20000, lpProcName="EndEnumeration") returned 0x6cf273c0
	[0161.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x571f040, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23
	[0161.412] GetProcAddress (hModule=0x6cf20000, lpProcName="GetPropertyQualifierSet") returned 0x6cf278b0
	[0161.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x571f054, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonemaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 5
	[0161.475] GetProcAddress (hModule=0x6cf20000, lpProcName="Clone") returned 0x6cf26f30
	[0161.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x571f04c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectTextmaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 13
	[0161.502] GetProcAddress (hModule=0x6cf20000, lpProcName="GetObjectText") returned 0x6cf277f0
	[0161.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x571f048, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClassmaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 17
	[0161.522] GetProcAddress (hModule=0x6cf20000, lpProcName="SpawnDerivedClass") returned 0x6cf27e80
	[0161.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x571f04c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstancemaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 13
	[0161.604] GetProcAddress (hModule=0x6cf20000, lpProcName="SpawnInstance") returned 0x6cf27eb0
	[0161.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x571f050, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTomaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 9
	[0161.607] GetProcAddress (hModule=0x6cf20000, lpProcName="CompareTo") returned 0x6cf27020
	[0161.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x571f048, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOriginmaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 17
	[0161.628] GetProcAddress (hModule=0x6cf20000, lpProcName="GetPropertyOrigin") returned 0x6cf27880
	[0161.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x571f04c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 12
	[0161.714] GetProcAddress (hModule=0x6cf20000, lpProcName="InheritsFrom") returned 0x6cf27900
	[0161.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x571f050, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodmaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 9
	[0161.717] GetProcAddress (hModule=0x6cf20000, lpProcName="GetMethod") returned 0x6cf27730
	[0161.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x571f050, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethodmaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 9
	[0161.758] GetProcAddress (hModule=0x6cf20000, lpProcName="PutMethod") returned 0x6cf27bf0
	[0161.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x571f04c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 12
	[0161.788] GetProcAddress (hModule=0x6cf20000, lpProcName="DeleteMethod") returned 0x6cf27320
	[0161.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x571f044, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 22
	[0161.802] GetProcAddress (hModule=0x6cf20000, lpProcName="BeginMethodEnumeration") returned 0x6cf26e50
	[0161.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x571f050, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 10
	[0161.804] GetProcAddress (hModule=0x6cf20000, lpProcName="NextMethod") returned 0x6cf279d0
	[0161.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x571f044, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 20
	[0161.822] GetProcAddress (hModule=0x6cf20000, lpProcName="EndMethodEnumeration") returned 0x6cf273e0
	[0161.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x571f044, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSetmaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 21
	[0161.825] GetProcAddress (hModule=0x6cf20000, lpProcName="GetMethodQualifierSet") returned 0x6cf27790
	[0161.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x571f048, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15
	[0161.828] GetProcAddress (hModule=0x6cf20000, lpProcName="GetMethodOrigin") returned 0x6cf27760
	[0161.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x571f048, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 16
	[0161.831] GetProcAddress (hModule=0x6cf20000, lpProcName="QualifierSet_Get") returned 0x6cf27c80
	[0161.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x571f048, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 16
	[0161.882] GetProcAddress (hModule=0x6cf20000, lpProcName="QualifierSet_Put") returned 0x6cf27d10
	[0161.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x571f044, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19
	[0161.922] GetProcAddress (hModule=0x6cf20000, lpProcName="QualifierSet_Delete") returned 0x6cf27c40
	[0161.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x571f044, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNamesmaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 21
	[0161.925] GetProcAddress (hModule=0x6cf20000, lpProcName="QualifierSet_GetNames") returned 0x6cf27cb0
	[0161.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x571f03c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumerationmaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 29
	[0161.947] GetProcAddress (hModule=0x6cf20000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6cf27c20
	[0161.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x571f048, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Nextmaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 17
	[0161.950] GetProcAddress (hModule=0x6cf20000, lpProcName="QualifierSet_Next") returned 0x6cf27ce0
	[0162.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x571f03c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27
	[0162.015] GetProcAddress (hModule=0x6cf20000, lpProcName="QualifierSet_EndEnumeration") returned 0x6cf27c60
	[0162.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x571f040, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23
	[0162.018] GetProcAddress (hModule=0x6cf20000, lpProcName="GetCurrentApartmentType") returned 0x6cf278e0
	[0162.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x571f044, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 20
	[0162.033] GetProcAddress (hModule=0x6cf20000, lpProcName="GetDemultiplexedStub") returned 0x6cf275f0
	[0162.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x571f044, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmimaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 21
	[0162.067] GetProcAddress (hModule=0x6cf20000, lpProcName="CreateInstanceEnumWmi") returned 0x6cf27230
	[0162.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x571f048, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 18
	[0162.143] GetProcAddress (hModule=0x6cf20000, lpProcName="CreateClassEnumWmi") returned 0x6cf27160
	[0162.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x571f04c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 12
	[0162.145] GetProcAddress (hModule=0x6cf20000, lpProcName="ExecQueryWmi") returned 0x6cf274e0
	[0162.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x571f040, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 24
	[0162.370] GetProcAddress (hModule=0x6cf20000, lpProcName="ExecNotificationQueryWmi") returned 0x6cf27400
	[0162.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x571f04c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 14
	[0162.376] GetProcAddress (hModule=0x6cf20000, lpProcName="PutInstanceWmi") returned 0x6cf27b10
	[0162.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x571f04c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11
	[0162.488] GetProcAddress (hModule=0x6cf20000, lpProcName="PutClassWmi") returned 0x6cf27a30
	[0162.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x571f040, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 24
	[0162.491] GetProcAddress (hModule=0x6cf20000, lpProcName="CloneEnumWbemClassObject") returned 0x6cf26f50
	[0162.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x571f048, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 16
	[0162.633] GetProcAddress (hModule=0x6cf20000, lpProcName="ConnectServerWmi") returned 0x6cf27050
	[0162.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetErrorInfo", cchWideChar=12, lpMultiByteStr=0x571f04c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetErrorInfo»maob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 12
	[0162.827] GetProcAddress (hModule=0x6cf20000, lpProcName="GetErrorInfo") returned 0x6cf27650
	[0162.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Initialize", cchWideChar=10, lpMultiByteStr=0x571f050, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Initializeaob\x9d\x1a Dþ<r(óq\x05", lpUsedDefaultChar=0x0) returned 10
	[0162.837] GetProcAddress (hModule=0x6cf20000, lpProcName="Initialize") returned 0x6cf27920
	[0162.856] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x571f000 | out: phkResult=0x571f000*=0x320) returned 0x0
	[0162.857] RegQueryValueExW (in: hKey=0x320, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x571f01c, lpData=0x0, lpcbData=0x571f018*=0x0 | out: lpType=0x571f01c*=0x0, lpData=0x0, lpcbData=0x571f018*=0x0) returned 0x2
	[0162.857] RegCloseKey (hKey=0x320) returned 0x0
	[0162.858] CoCreateInstance (in: rclsid=0x6cf23734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6cf23794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x571f778 | out: ppv=0x571f778*=0xa498b8) returned 0x0
	[0162.859] WbemLocator:IWbemLocator:ConnectServer (in: This=0xa498b8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x571f818 | out: ppNamespace=0x571f818*=0xa52128) returned 0x0
	[0162.992] WbemLocator:IUnknown:QueryInterface (in: This=0xa52128, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x571f69c | out: ppvObject=0x571f69c*=0xa5a6e4) returned 0x0
	[0162.992] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xa5a6e4, pProxy=0xa52128, pAuthnSvc=0x571f6ec, pAuthzSvc=0x571f6e8, pServerPrincName=0x571f6e0, pAuthnLevel=0x571f6e4, pImpLevel=0x571f6d4, pAuthInfo=0x571f6d8, pCapabilites=0x571f6dc | out: pAuthnSvc=0x571f6ec*=0xa, pAuthzSvc=0x571f6e8*=0x0, pServerPrincName=0x571f6e0, pAuthnLevel=0x571f6e4*=0x6, pImpLevel=0x571f6d4*=0x2, pAuthInfo=0x571f6d8, pCapabilites=0x571f6dc*=0x1) returned 0x0
	[0162.992] WbemLocator:IUnknown:Release (This=0xa5a6e4) returned 0x1
	[0162.993] WbemLocator:IUnknown:QueryInterface (in: This=0xa52128, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x571f690 | out: ppvObject=0x571f690*=0xa5a704) returned 0x0
	[0162.993] WbemLocator:IUnknown:QueryInterface (in: This=0xa52128, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x571f67c | out: ppvObject=0x571f67c*=0xa5a6e4) returned 0x0
	[0162.993] WbemLocator:IClientSecurity:SetBlanket (This=0xa5a6e4, pProxy=0xa52128, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0162.993] WbemLocator:IUnknown:Release (This=0xa5a6e4) returned 0x2
	[0162.993] WbemLocator:IUnknown:Release (This=0xa5a704) returned 0x1
	[0162.993] CoTaskMemFree (pv=0xa534c8) 
	[0162.994] WbemLocator:IUnknown:AddRef (This=0xa52128) returned 0x2
	[0162.994] WbemLocator:IUnknown:Release (This=0xa498b8) returned 0x0
	[0162.995] CoGetContextToken (in: pToken=0x571ebd0 | out: pToken=0x571ebd0) returned 0x0
	[0162.996] CoGetContextToken (in: pToken=0x571efe4 | out: pToken=0x571efe4) returned 0x0
	[0162.996] WbemLocator:IUnknown:QueryInterface (in: This=0xa52128, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x571ef7c | out: ppvObject=0x571ef7c*=0xa5a6ec) returned 0x0
	[0162.996] WbemLocator:IRpcOptions:Query (in: This=0xa5a6ec, pPrx=0xa5d330, dwProperty=2, pdwValue=0x571f070 | out: pdwValue=0x571f070) returned 0x80004002
	[0162.997] WbemLocator:IUnknown:Release (This=0xa5a6ec) returned 0x2
	[0162.997] CoGetContextToken (in: pToken=0x571f5b4 | out: pToken=0x571f5b4) returned 0x0
	[0162.997] CoGetContextToken (in: pToken=0x571f514 | out: pToken=0x571f514) returned 0x0
	[0162.997] WbemLocator:IUnknown:QueryInterface (in: This=0xa52128, riid=0x571f5e4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x571f4b0 | out: ppvObject=0x571f4b0*=0xa52128) returned 0x0
	[0162.998] WbemLocator:IUnknown:Release (This=0xa52128) returned 0x2
	[0163.012] SysStringLen (param_1=0x0) returned 0x0
	[0163.014] CoUninitialize () 

Thread:
	id = 97
	os_tid = 0xafc

	[0163.111] CoGetContextToken (in: pToken=0x567f090 | out: pToken=0x567f090) returned 0x0
	[0163.111] CoGetContextToken (in: pToken=0x567f07c | out: pToken=0x567f07c) returned 0x0
	[0163.112] CoGetMarshalSizeMax (in: pulSize=0x567f038, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa5d330, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x567f038) returned 0x0
	[0163.114] CoMarshalInterface (pStm=0xa2b490, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa5d330, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0

Thread:
	id = 98
	os_tid = 0xb08

	[0163.151] WbemLocator:IUnknown:QueryInterface (in: This=0xa52128, riid=0xa2caf8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x580f150 | out: ppvObject=0x580f150*=0xa52128) returned 0x0
	[0163.152] WbemLocator:IUnknown:QueryInterface (in: This=0xa52128, riid=0x6d0362ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x580f0ec | out: ppvObject=0x580f0ec*=0xa52128) returned 0x0
	[0163.152] WbemLocator:IUnknown:QueryInterface (in: This=0xa52128, riid=0x6d0362ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x580f0a4 | out: ppvObject=0x580f0a4*=0xa52128) returned 0x0
	[0163.200] IWbemServices:GetObject (in: This=0xa52128, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x580f270*=0x0, ppCallResult=0x0 | out: ppObject=0x580f270*=0xa734d0, ppCallResult=0x0) returned 0x0
	[0164.651] CoGetContextToken (in: pToken=0x580f270 | out: pToken=0x580f270) returned 0x0
	[0164.651] CoGetContextToken (in: pToken=0x580f25c | out: pToken=0x580f25c) returned 0x0
	[0164.651] CoGetMarshalSizeMax (in: pulSize=0x580f218, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa6d688, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x580f218) returned 0x0
	[0164.652] CoMarshalInterface (pStm=0xa2b470, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xa6d688, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
	[0164.655] WbemLocator:IUnknown:QueryInterface (in: This=0xa523a8, riid=0xa2ccd8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x580f150 | out: ppvObject=0x580f150*=0xa523a8) returned 0x0
	[0164.655] WbemLocator:IUnknown:QueryInterface (in: This=0xa523a8, riid=0x6d0362ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x580f0ec | out: ppvObject=0x580f0ec*=0xa523a8) returned 0x0
	[0164.655] WbemLocator:IUnknown:QueryInterface (in: This=0xa523a8, riid=0x6d0362ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x580f0a4 | out: ppvObject=0x580f0a4*=0xa523a8) returned 0x0
	[0164.656] IWbemServices:GetObject (in: This=0xa523a8, strObjectPath="Win32_NetworkAdapterConfiguration", lFlags=0, pCtx=0x0, ppObject=0x580f270*=0x0, ppCallResult=0x0 | out: ppObject=0x580f270*=0xa73e18, ppCallResult=0x0) returned 0x0

Thread:
	id = 100
	os_tid = 0xaf8

	[0164.397] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0164.399] CoGetClassObject (in: rclsid=0xa53414*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5a3f330 | out: ppv=0x5a3f330*=0xa6d5e0) returned 0x0
	[0164.400] WbemLocator:IUnknown:QueryInterface (in: This=0xa6d5e0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5a3f548 | out: ppvObject=0x5a3f548*=0x0) returned 0x80004002
	[0164.400] WbemLocator:IClassFactory:CreateInstance (in: This=0xa6d5e0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a3f554 | out: ppvObject=0x5a3f554*=0x9f6ad0) returned 0x0
	[0164.400] WbemLocator:IUnknown:Release (This=0xa6d5e0) returned 0x0
	[0164.400] WbemLocator:IUnknown:QueryInterface (in: This=0x9f6ad0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a3f174 | out: ppvObject=0x5a3f174*=0x9f6ad0) returned 0x0
	[0164.400] WbemLocator:IUnknown:QueryInterface (in: This=0x9f6ad0, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5a3f128 | out: ppvObject=0x5a3f128*=0x0) returned 0x80004002
	[0164.401] WbemLocator:IUnknown:AddRef (This=0x9f6ad0) returned 0x3
	[0164.401] WbemLocator:IUnknown:QueryInterface (in: This=0x9f6ad0, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5a3ea84 | out: ppvObject=0x5a3ea84*=0x0) returned 0x80004002
	[0164.401] WbemLocator:IUnknown:QueryInterface (in: This=0x9f6ad0, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5a3ea34 | out: ppvObject=0x5a3ea34*=0x0) returned 0x80004002
	[0164.401] WbemLocator:IUnknown:QueryInterface (in: This=0x9f6ad0, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a3ea40 | out: ppvObject=0x5a3ea40*=0x0) returned 0x80004002
	[0164.401] CoGetContextToken (in: pToken=0x5a3eaa0 | out: pToken=0x5a3eaa0) returned 0x0
	[0164.402] CoGetContextToken (in: pToken=0x5a3eeb4 | out: pToken=0x5a3eeb4) returned 0x0
	[0164.402] WbemLocator:IUnknown:QueryInterface (in: This=0x9f6ad0, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a3ef34 | out: ppvObject=0x5a3ef34*=0x0) returned 0x80004002
	[0164.402] WbemLocator:IUnknown:Release (This=0x9f6ad0) returned 0x2
	[0164.403] WbemLocator:IUnknown:Release (This=0x9f6ad0) returned 0x1
	[0164.403] CoGetContextToken (in: pToken=0x5a3f52c | out: pToken=0x5a3f52c) returned 0x0
	[0164.403] CoGetContextToken (in: pToken=0x5a3f48c | out: pToken=0x5a3f48c) returned 0x0
	[0164.403] WbemLocator:IUnknown:QueryInterface (in: This=0x9f6ad0, riid=0x5a3f55c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5a3f558 | out: ppvObject=0x5a3f558*=0x9f6ad0) returned 0x0
	[0164.403] WbemLocator:IUnknown:AddRef (This=0x9f6ad0) returned 0x3
	[0164.403] WbemLocator:IUnknown:Release (This=0x9f6ad0) returned 0x2
	[0164.403] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa226a0, puCount=0x5a3f6ec | out: puCount=0x5a3f6ec*=0x2) returned 0x0
	[0164.403] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=8, puBuffLength=0x5a3f6e8*=0x0, pszText=0x0 | out: puBuffLength=0x5a3f6e8*=0xf, pszText=0x0) returned 0x0
	[0164.403] WbemDefPath:IWbemPath:GetText (in: This=0xa226a0, lFlags=8, puBuffLength=0x5a3f6e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5a3f6e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0164.403] CoCreateInstance (in: rclsid=0x6cf23734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6cf23794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5a3f598 | out: ppv=0x5a3f598*=0xa76bc0) returned 0x0
	[0164.403] WbemLocator:IWbemLocator:ConnectServer (in: This=0xa76bc0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5a3f638 | out: ppNamespace=0x5a3f638*=0xa523a8) returned 0x0
	[0164.594] WbemLocator:IUnknown:QueryInterface (in: This=0xa523a8, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a3f4bc | out: ppvObject=0x5a3f4bc*=0xa5ab94) returned 0x0
	[0164.594] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xa5ab94, pProxy=0xa523a8, pAuthnSvc=0x5a3f50c, pAuthzSvc=0x5a3f508, pServerPrincName=0x5a3f500, pAuthnLevel=0x5a3f504, pImpLevel=0x5a3f4f4, pAuthInfo=0x5a3f4f8, pCapabilites=0x5a3f4fc | out: pAuthnSvc=0x5a3f50c*=0xa, pAuthzSvc=0x5a3f508*=0x0, pServerPrincName=0x5a3f500, pAuthnLevel=0x5a3f504*=0x6, pImpLevel=0x5a3f4f4*=0x2, pAuthInfo=0x5a3f4f8, pCapabilites=0x5a3f4fc*=0x1) returned 0x0
	[0164.594] WbemLocator:IUnknown:Release (This=0xa5ab94) returned 0x1
	[0164.594] WbemLocator:IUnknown:QueryInterface (in: This=0xa523a8, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a3f4b0 | out: ppvObject=0x5a3f4b0*=0xa5abb4) returned 0x0
	[0164.594] WbemLocator:IUnknown:QueryInterface (in: This=0xa523a8, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a3f49c | out: ppvObject=0x5a3f49c*=0xa5ab94) returned 0x0
	[0164.594] WbemLocator:IClientSecurity:SetBlanket (This=0xa5ab94, pProxy=0xa523a8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0164.594] WbemLocator:IUnknown:Release (This=0xa5ab94) returned 0x2
	[0164.594] WbemLocator:IUnknown:Release (This=0xa5abb4) returned 0x1
	[0164.594] CoTaskMemFree (pv=0xa53768) 
	[0164.595] WbemLocator:IUnknown:AddRef (This=0xa523a8) returned 0x2
	[0164.595] WbemLocator:IUnknown:Release (This=0xa76bc0) returned 0x0
	[0164.596] CoGetContextToken (in: pToken=0x5a3e9f0 | out: pToken=0x5a3e9f0) returned 0x0
	[0164.596] CoGetContextToken (in: pToken=0x5a3ee04 | out: pToken=0x5a3ee04) returned 0x0
	[0164.596] WbemLocator:IUnknown:QueryInterface (in: This=0xa523a8, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a3ed9c | out: ppvObject=0x5a3ed9c*=0xa5ab9c) returned 0x0
	[0164.596] WbemLocator:IRpcOptions:Query (in: This=0xa5ab9c, pPrx=0xa6d688, dwProperty=2, pdwValue=0x5a3ee90 | out: pdwValue=0x5a3ee90) returned 0x80004002
	[0164.596] WbemLocator:IUnknown:Release (This=0xa5ab9c) returned 0x2
	[0164.596] CoGetContextToken (in: pToken=0x5a3f3d4 | out: pToken=0x5a3f3d4) returned 0x0
	[0164.596] CoGetContextToken (in: pToken=0x5a3f334 | out: pToken=0x5a3f334) returned 0x0
	[0164.596] WbemLocator:IUnknown:QueryInterface (in: This=0xa523a8, riid=0x5a3f404*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5a3f2d0 | out: ppvObject=0x5a3f2d0*=0xa523a8) returned 0x0
	[0164.597] WbemLocator:IUnknown:Release (This=0xa523a8) returned 0x2
	[0164.597] SysStringLen (param_1=0x0) returned 0x0
	[0164.597] CoUninitialize () 

Thread:
	id = 102
	os_tid = 0xae4

	[0165.821] CoGetContextToken (in: pToken=0x523fb74 | out: pToken=0x523fb74) returned 0x0
	[0165.821] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x523fb98 | out: ppvObject=0x523fb98*=0x9f1eac) returned 0x0
	[0165.823] IComThreadingInfo:GetCurrentThreadType (in: This=0x9f1eac, pThreadType=0x523fbc4 | out: pThreadType=0x523fbc4*=0) returned 0x0
	[0165.823] IUnknown:Release (This=0x9f1eac) returned 0x1
	[0165.823] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0

Thread:
	id = 103
	os_tid = 0xaec

	[0166.003] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0166.006] CoGetContextToken (in: pToken=0x5a6f564 | out: pToken=0x5a6f564) returned 0x0
	[0166.006] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a6f588 | out: ppvObject=0x5a6f588*=0x9f1eac) returned 0x0
	[0166.006] IComThreadingInfo:GetCurrentThreadType (in: This=0x9f1eac, pThreadType=0x5a6f5b4 | out: pThreadType=0x5a6f5b4*=0) returned 0x0
	[0166.006] IUnknown:Release (This=0x9f1eac) returned 0x1
	[0166.006] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0166.006] CoUninitialize () 
	[0189.041] CoUninitialize () 

Thread:
	id = 104
	os_tid = 0xae8


Thread:
	id = 138
	os_tid = 0x548

	[0198.537] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0198.539] CoGetContextToken (in: pToken=0x572f9d4 | out: pToken=0x572f9d4) returned 0x0
	[0198.540] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572f9f8 | out: ppvObject=0x572f9f8*=0x9f1eac) returned 0x0
	[0198.540] IComThreadingInfo:GetCurrentThreadType (in: This=0x9f1eac, pThreadType=0x572fa24 | out: pThreadType=0x572fa24*=0) returned 0x0
	[0198.540] IUnknown:Release (This=0x9f1eac) returned 0x1
	[0198.540] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0198.540] CoUninitialize () 
	[0198.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x572f5bc | out: lpSystemTimeAsFileTime=0x572f5bc*(dwLowDateTime=0x84f93600, dwHighDateTime=0x1d7b3aa)) 
	[0198.546] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x572f22c | out: pTimeZoneInformation=0x572f22c) returned 0x2
	[0198.568] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x572f310 | out: phkResult=0x572f310*=0x374) returned 0x0
	[0198.569] RegQueryValueExW (in: hKey=0x374, lpValueName="TZI", lpReserved=0x0, lpType=0x572f32c, lpData=0x0, lpcbData=0x572f328*=0x0 | out: lpType=0x572f32c*=0x3, lpData=0x0, lpcbData=0x572f328*=0x2c) returned 0x0
	[0198.569] RegQueryValueExW (in: hKey=0x374, lpValueName="TZI", lpReserved=0x0, lpType=0x572f32c, lpData=0x22d362c, lpcbData=0x572f328*=0x2c | out: lpType=0x572f32c*=0x3, lpData=0x22d362c*, lpcbData=0x572f328*=0x2c) returned 0x0
	[0198.571] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x572f164 | out: phkResult=0x572f164*=0x0) returned 0x2
	[0198.576] RegQueryValueExW (in: hKey=0x374, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x572f304, lpData=0x0, lpcbData=0x572f300*=0x0 | out: lpType=0x572f304*=0x1, lpData=0x0, lpcbData=0x572f300*=0x20) returned 0x0
	[0198.576] RegQueryValueExW (in: hKey=0x374, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x572f304, lpData=0x22d3b38, lpcbData=0x572f300*=0x20 | out: lpType=0x572f304*=0x1, lpData="@tzres.dll,-320", lpcbData=0x572f300*=0x20) returned 0x0
	[0198.577] RegQueryValueExW (in: hKey=0x374, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x572f304, lpData=0x0, lpcbData=0x572f300*=0x0 | out: lpType=0x572f304*=0x1, lpData=0x0, lpcbData=0x572f300*=0x20) returned 0x0
	[0198.577] RegQueryValueExW (in: hKey=0x374, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x572f304, lpData=0x22d3b90, lpcbData=0x572f300*=0x20 | out: lpType=0x572f304*=0x1, lpData="@tzres.dll,-322", lpcbData=0x572f300*=0x20) returned 0x0
	[0198.577] RegQueryValueExW (in: hKey=0x374, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x572f304, lpData=0x0, lpcbData=0x572f300*=0x0 | out: lpType=0x572f304*=0x1, lpData=0x0, lpcbData=0x572f300*=0x20) returned 0x0
	[0198.577] RegQueryValueExW (in: hKey=0x374, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x572f304, lpData=0x22d3be8, lpcbData=0x572f300*=0x20 | out: lpType=0x572f304*=0x1, lpData="@tzres.dll,-321", lpcbData=0x572f300*=0x20) returned 0x0
	[0198.580] CoTaskMemAlloc (cb=0x20c) returned 0xa645f8
	[0198.580] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xa645f8 | out: pszPath="C:\\Windows\\system32") returned 0x0
	[0198.580] CoTaskMemFree (pv=0xa645f8) 
	[0198.582] CoTaskMemAlloc (cb=0x20c) returned 0xa645f8
	[0198.582] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x572f320, pwszFileMUIPath=0xa645f8, pcchFileMUIPath=0x572f324, pululEnumerator=0x572f318 | out: pwszLanguage=0x0, pcchLanguage=0x572f320, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x572f324, pululEnumerator=0x572f318) returned 1
	[0198.585] CoTaskMemFree (pv=0x0) 
	[0198.585] CoTaskMemFree (pv=0xa645f8) 
	[0198.587] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1fa0001
	[0198.591] CoTaskMemAlloc (cb=0x3ec) returned 0xa63d88
	[0198.591] LoadStringW (in: hInstance=0x1fa0001, uID=0x140, lpBuffer=0xa63d88, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c
	[0198.591] CoTaskMemFree (pv=0xa63d88) 
	[0198.591] FreeLibrary (hLibModule=0x1fa0001) returned 1
	[0198.592] CoTaskMemAlloc (cb=0x20c) returned 0xa645f8
	[0198.592] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xa645f8 | out: pszPath="C:\\Windows\\system32") returned 0x0
	[0198.593] CoTaskMemFree (pv=0xa645f8) 
	[0198.593] CoTaskMemAlloc (cb=0x20c) returned 0xa645f8
	[0198.593] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x572f320, pwszFileMUIPath=0xa645f8, pcchFileMUIPath=0x572f324, pululEnumerator=0x572f318 | out: pwszLanguage=0x0, pcchLanguage=0x572f320, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x572f324, pululEnumerator=0x572f318) returned 1
	[0198.596] CoTaskMemFree (pv=0x0) 
	[0198.596] CoTaskMemFree (pv=0xa645f8) 
	[0198.596] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1fa0001
	[0198.600] CoTaskMemAlloc (cb=0x3ec) returned 0xa63d88
	[0198.600] LoadStringW (in: hInstance=0x1fa0001, uID=0x142, lpBuffer=0xa63d88, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17
	[0198.600] CoTaskMemFree (pv=0xa63d88) 
	[0198.600] FreeLibrary (hLibModule=0x1fa0001) returned 1
	[0198.601] CoTaskMemAlloc (cb=0x20c) returned 0xa645f8
	[0198.601] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xa645f8 | out: pszPath="C:\\Windows\\system32") returned 0x0
	[0198.602] CoTaskMemFree (pv=0xa645f8) 
	[0198.602] CoTaskMemAlloc (cb=0x20c) returned 0xa645f8
	[0198.602] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x572f320, pwszFileMUIPath=0xa645f8, pcchFileMUIPath=0x572f324, pululEnumerator=0x572f318 | out: pwszLanguage=0x0, pcchLanguage=0x572f320, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x572f324, pululEnumerator=0x572f318) returned 1
	[0198.604] CoTaskMemFree (pv=0x0) 
	[0198.604] CoTaskMemFree (pv=0xa645f8) 
	[0198.605] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1fa0001
	[0198.608] CoTaskMemAlloc (cb=0x3ec) returned 0xa63d88
	[0198.608] LoadStringW (in: hInstance=0x1fa0001, uID=0x141, lpBuffer=0xa63d88, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17
	[0198.608] CoTaskMemFree (pv=0xa63d88) 
	[0198.608] FreeLibrary (hLibModule=0x1fa0001) returned 1
	[0198.610] RegCloseKey (hKey=0x374) returned 0x0
	[0198.641] GetLastInputInfo (in: plii=0x22323f8 | out: plii=0x22323f8*(cbSize=0x8, dwTime=0x17ff647)) returned 1
	[0218.994] CoUninitialize () 

Thread:
	id = 139
	os_tid = 0x538


Thread:
	id = 140
	os_tid = 0x424

	[0198.649] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0198.651] CoGetContextToken (in: pToken=0x5a6f964 | out: pToken=0x5a6f964) returned 0x0
	[0198.651] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a6f988 | out: ppvObject=0x5a6f988*=0x9f1eac) returned 0x0
	[0198.651] IComThreadingInfo:GetCurrentThreadType (in: This=0x9f1eac, pThreadType=0x5a6f9b4 | out: pThreadType=0x5a6f9b4*=0) returned 0x0
	[0198.651] IUnknown:Release (This=0x9f1eac) returned 0x1
	[0198.651] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0198.652] CoUninitialize () 
	[0219.005] CoUninitialize () 

Thread:
	id = 142
	os_tid = 0xd38

	[0228.959] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0228.963] CoGetContextToken (in: pToken=0x56ef3e4 | out: pToken=0x56ef3e4) returned 0x0
	[0228.963] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x56ef408 | out: ppvObject=0x56ef408*=0x9f1eac) returned 0x0
	[0228.963] IComThreadingInfo:GetCurrentThreadType (in: This=0x9f1eac, pThreadType=0x56ef434 | out: pThreadType=0x56ef434*=0) returned 0x0
	[0228.963] IUnknown:Release (This=0x9f1eac) returned 0x1
	[0228.963] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0228.964] CoUninitialize () 
	[0228.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x56eefcc | out: lpSystemTimeAsFileTime=0x56eefcc*(dwLowDateTime=0x96dd0b80, dwHighDateTime=0x1d7b3aa)) 
	[0228.970] GetLastInputInfo (in: plii=0x22323f8 | out: plii=0x22323f8*(cbSize=0x8, dwTime=0x1806906)) returned 1
	[0249.209] CoUninitialize () 

Thread:
	id = 143
	os_tid = 0xd80


Thread:
	id = 144
	os_tid = 0x6a8

	[0228.986] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0228.989] CoGetContextToken (in: pToken=0x5a7f2b4 | out: pToken=0x5a7f2b4) returned 0x0
	[0228.989] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a7f2d8 | out: ppvObject=0x5a7f2d8*=0x9f1eac) returned 0x0
	[0228.990] IComThreadingInfo:GetCurrentThreadType (in: This=0x9f1eac, pThreadType=0x5a7f304 | out: pThreadType=0x5a7f304*=0) returned 0x0
	[0228.990] IUnknown:Release (This=0x9f1eac) returned 0x1
	[0228.990] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0228.990] CoUninitialize () 
	[0249.198] CoUninitialize () 

Thread:
	id = 146
	os_tid = 0x82c

	[0255.889] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0255.892] CoGetClassObject (in: rclsid=0xa53414*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x569ea70 | out: ppv=0x569ea70*=0x574e330) returned 0x0
	[0255.892] WbemLocator:IUnknown:QueryInterface (in: This=0x574e330, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x569ec88 | out: ppvObject=0x569ec88*=0x0) returned 0x80004002
	[0255.892] WbemLocator:IClassFactory:CreateInstance (in: This=0x574e330, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x569ec94 | out: ppvObject=0x569ec94*=0xa91d50) returned 0x0
	[0255.892] WbemLocator:IUnknown:Release (This=0x574e330) returned 0x0
	[0255.893] WbemLocator:IUnknown:QueryInterface (in: This=0xa91d50, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x569e8b4 | out: ppvObject=0x569e8b4*=0xa91d50) returned 0x0
	[0255.893] WbemLocator:IUnknown:QueryInterface (in: This=0xa91d50, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x569e868 | out: ppvObject=0x569e868*=0x0) returned 0x80004002
	[0255.893] WbemLocator:IUnknown:AddRef (This=0xa91d50) returned 0x3
	[0255.893] WbemLocator:IUnknown:QueryInterface (in: This=0xa91d50, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x569e1c4 | out: ppvObject=0x569e1c4*=0x0) returned 0x80004002
	[0255.893] WbemLocator:IUnknown:QueryInterface (in: This=0xa91d50, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x569e174 | out: ppvObject=0x569e174*=0x0) returned 0x80004002
	[0255.893] WbemLocator:IUnknown:QueryInterface (in: This=0xa91d50, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x569e180 | out: ppvObject=0x569e180*=0x0) returned 0x80004002
	[0255.893] CoGetContextToken (in: pToken=0x569e1e0 | out: pToken=0x569e1e0) returned 0x0
	[0255.896] CoGetContextToken (in: pToken=0x569e5f4 | out: pToken=0x569e5f4) returned 0x0
	[0255.896] WbemLocator:IUnknown:QueryInterface (in: This=0xa91d50, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x569e674 | out: ppvObject=0x569e674*=0x0) returned 0x80004002
	[0255.896] WbemLocator:IUnknown:Release (This=0xa91d50) returned 0x2
	[0255.896] WbemLocator:IUnknown:Release (This=0xa91d50) returned 0x1
	[0255.896] CoGetContextToken (in: pToken=0x569ec6c | out: pToken=0x569ec6c) returned 0x0
	[0255.896] CoGetContextToken (in: pToken=0x569ebcc | out: pToken=0x569ebcc) returned 0x0
	[0255.896] WbemLocator:IUnknown:QueryInterface (in: This=0xa91d50, riid=0x569ec9c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x569ec98 | out: ppvObject=0x569ec98*=0xa91d50) returned 0x0
	[0255.896] WbemLocator:IUnknown:AddRef (This=0xa91d50) returned 0x3
	[0255.896] WbemLocator:IUnknown:Release (This=0xa91d50) returned 0x2
	[0255.896] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x569ee2c | out: puCount=0x569ee2c*=0x2) returned 0x0
	[0255.896] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=8, puBuffLength=0x569ee28*=0x0, pszText=0x0 | out: puBuffLength=0x569ee28*=0xf, pszText=0x0) returned 0x0
	[0255.897] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=8, puBuffLength=0x569ee28*=0xf, pszText="00000000000000" | out: puBuffLength=0x569ee28*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0255.897] CoCreateInstance (in: rclsid=0x6cf23734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6cf23794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x569ecd8 | out: ppv=0x569ecd8*=0xa91d70) returned 0x0
	[0255.897] WbemLocator:IWbemLocator:ConnectServer (in: This=0xa91d70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x569ed78 | out: ppNamespace=0x569ed78*=0x573e360) returned 0x0
	[0255.932] WbemLocator:IUnknown:QueryInterface (in: This=0x573e360, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x569ebfc | out: ppvObject=0x569ebfc*=0xa5af54) returned 0x0
	[0255.933] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xa5af54, pProxy=0x573e360, pAuthnSvc=0x569ec4c, pAuthzSvc=0x569ec48, pServerPrincName=0x569ec40, pAuthnLevel=0x569ec44, pImpLevel=0x569ec34, pAuthInfo=0x569ec38, pCapabilites=0x569ec3c | out: pAuthnSvc=0x569ec4c*=0xa, pAuthzSvc=0x569ec48*=0x0, pServerPrincName=0x569ec40, pAuthnLevel=0x569ec44*=0x6, pImpLevel=0x569ec34*=0x2, pAuthInfo=0x569ec38, pCapabilites=0x569ec3c*=0x1) returned 0x0
	[0255.933] WbemLocator:IUnknown:Release (This=0xa5af54) returned 0x1
	[0255.933] WbemLocator:IUnknown:QueryInterface (in: This=0x573e360, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x569ebf0 | out: ppvObject=0x569ebf0*=0xa5af74) returned 0x0
	[0255.933] WbemLocator:IUnknown:QueryInterface (in: This=0x573e360, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x569ebdc | out: ppvObject=0x569ebdc*=0xa5af54) returned 0x0
	[0255.933] WbemLocator:IClientSecurity:SetBlanket (This=0xa5af54, pProxy=0x573e360, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0255.933] WbemLocator:IUnknown:Release (This=0xa5af54) returned 0x2
	[0255.933] WbemLocator:IUnknown:Release (This=0xa5af74) returned 0x1
	[0255.933] CoTaskMemFree (pv=0x574db30) 
	[0255.934] WbemLocator:IUnknown:AddRef (This=0x573e360) returned 0x2
	[0255.934] WbemLocator:IUnknown:Release (This=0xa91d70) returned 0x0
	[0255.934] CoGetContextToken (in: pToken=0x569e130 | out: pToken=0x569e130) returned 0x0
	[0255.935] CoGetContextToken (in: pToken=0x569e544 | out: pToken=0x569e544) returned 0x0
	[0255.935] WbemLocator:IUnknown:QueryInterface (in: This=0x573e360, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x569e4dc | out: ppvObject=0x569e4dc*=0xa5af5c) returned 0x0
	[0255.935] WbemLocator:IRpcOptions:Query (in: This=0xa5af5c, pPrx=0x574e3f0, dwProperty=2, pdwValue=0x569e5d0 | out: pdwValue=0x569e5d0) returned 0x80004002
	[0255.935] WbemLocator:IUnknown:Release (This=0xa5af5c) returned 0x2
	[0255.935] CoGetContextToken (in: pToken=0x569eb14 | out: pToken=0x569eb14) returned 0x0
	[0255.935] CoGetContextToken (in: pToken=0x569ea74 | out: pToken=0x569ea74) returned 0x0
	[0255.935] WbemLocator:IUnknown:QueryInterface (in: This=0x573e360, riid=0x569eb44*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x569ea10 | out: ppvObject=0x569ea10*=0x573e360) returned 0x0
	[0255.936] WbemLocator:IUnknown:Release (This=0x573e360) returned 0x2
	[0255.936] SysStringLen (param_1=0x0) returned 0x0
	[0255.936] CoUninitialize () 

Thread:
	id = 147
	os_tid = 0x830


Thread:
	id = 148
	os_tid = 0x834

	[0255.949] CoGetContextToken (in: pToken=0x5b9f1b0 | out: pToken=0x5b9f1b0) returned 0x0
	[0255.949] CoGetContextToken (in: pToken=0x5b9f19c | out: pToken=0x5b9f19c) returned 0x0
	[0255.949] CoGetMarshalSizeMax (in: pulSize=0x5b9f158, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x574e3f0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5b9f158) returned 0x0
	[0255.950] CoMarshalInterface (pStm=0xa9c6e8, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x574e3f0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
	[0256.142] CoGetContextToken (in: pToken=0x5b9f1b0 | out: pToken=0x5b9f1b0) returned 0x0
	[0256.142] CoGetContextToken (in: pToken=0x5b9f19c | out: pToken=0x5b9f19c) returned 0x0
	[0256.142] CoGetMarshalSizeMax (in: pulSize=0x5b9f158, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x574e858, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5b9f158) returned 0x0
	[0256.143] CoMarshalInterface (pStm=0xa9c848, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x574e858, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
	[0256.145] WbemLocator:IUnknown:QueryInterface (in: This=0x573e450, riid=0xa2d278*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5b9f090 | out: ppvObject=0x5b9f090*=0x573e450) returned 0x0
	[0256.146] WbemLocator:IUnknown:QueryInterface (in: This=0x573e450, riid=0x6d0362ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5b9f02c | out: ppvObject=0x5b9f02c*=0x573e450) returned 0x0
	[0256.146] WbemLocator:IUnknown:QueryInterface (in: This=0x573e450, riid=0x6d0362ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5b9efe4 | out: ppvObject=0x5b9efe4*=0x573e450) returned 0x0

Thread:
	id = 149
	os_tid = 0x84c

	[0255.955] WbemLocator:IUnknown:QueryInterface (in: This=0x573e360, riid=0xa2ceb8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x564f370 | out: ppvObject=0x564f370*=0x573e360) returned 0x0
	[0255.955] WbemLocator:IUnknown:QueryInterface (in: This=0x573e360, riid=0x6d0362ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x564f30c | out: ppvObject=0x564f30c*=0x573e360) returned 0x0
	[0255.955] WbemLocator:IUnknown:QueryInterface (in: This=0x573e360, riid=0x6d0362ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x564f2c4 | out: ppvObject=0x564f2c4*=0x573e360) returned 0x0

Thread:
	id = 157
	os_tid = 0xd94

	[0256.105] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0256.117] CoGetClassObject (in: rclsid=0xa53414*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x72536bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5d9eba0 | out: ppv=0x5d9eba0*=0x574e7b0) returned 0x0
	[0256.117] WbemLocator:IUnknown:QueryInterface (in: This=0x574e7b0, riid=0x724fdd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5d9edb8 | out: ppvObject=0x5d9edb8*=0x0) returned 0x80004002
	[0256.117] WbemLocator:IClassFactory:CreateInstance (in: This=0x574e7b0, pUnkOuter=0x0, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5d9edc4 | out: ppvObject=0x5d9edc4*=0xa91e60) returned 0x0
	[0256.117] WbemLocator:IUnknown:Release (This=0x574e7b0) returned 0x0
	[0256.118] WbemLocator:IUnknown:QueryInterface (in: This=0xa91e60, riid=0x723e2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5d9e9e4 | out: ppvObject=0x5d9e9e4*=0xa91e60) returned 0x0
	[0256.118] WbemLocator:IUnknown:QueryInterface (in: This=0xa91e60, riid=0x724d1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5d9e998 | out: ppvObject=0x5d9e998*=0x0) returned 0x80004002
	[0256.118] WbemLocator:IUnknown:AddRef (This=0xa91e60) returned 0x3
	[0256.119] WbemLocator:IUnknown:QueryInterface (in: This=0xa91e60, riid=0x724d182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5d9e2f4 | out: ppvObject=0x5d9e2f4*=0x0) returned 0x80004002
	[0256.119] WbemLocator:IUnknown:QueryInterface (in: This=0xa91e60, riid=0x724d1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5d9e2a4 | out: ppvObject=0x5d9e2a4*=0x0) returned 0x80004002
	[0256.119] WbemLocator:IUnknown:QueryInterface (in: This=0xa91e60, riid=0x72401388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5d9e2b0 | out: ppvObject=0x5d9e2b0*=0x0) returned 0x80004002
	[0256.119] CoGetContextToken (in: pToken=0x5d9e310 | out: pToken=0x5d9e310) returned 0x0
	[0256.120] CoGetContextToken (in: pToken=0x5d9e724 | out: pToken=0x5d9e724) returned 0x0
	[0256.120] WbemLocator:IUnknown:QueryInterface (in: This=0xa91e60, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5d9e7a4 | out: ppvObject=0x5d9e7a4*=0x0) returned 0x80004002
	[0256.120] WbemLocator:IUnknown:Release (This=0xa91e60) returned 0x2
	[0256.120] WbemLocator:IUnknown:Release (This=0xa91e60) returned 0x1
	[0256.120] CoGetContextToken (in: pToken=0x5d9ed9c | out: pToken=0x5d9ed9c) returned 0x0
	[0256.120] CoGetContextToken (in: pToken=0x5d9ecfc | out: pToken=0x5d9ecfc) returned 0x0
	[0256.120] WbemLocator:IUnknown:QueryInterface (in: This=0xa91e60, riid=0x5d9edcc*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5d9edc8 | out: ppvObject=0x5d9edc8*=0xa91e60) returned 0x0
	[0256.120] WbemLocator:IUnknown:AddRef (This=0xa91e60) returned 0x3
	[0256.120] WbemLocator:IUnknown:Release (This=0xa91e60) returned 0x2
	[0256.121] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa22470, puCount=0x5d9ef5c | out: puCount=0x5d9ef5c*=0x2) returned 0x0
	[0256.121] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=8, puBuffLength=0x5d9ef58*=0x0, pszText=0x0 | out: puBuffLength=0x5d9ef58*=0xf, pszText=0x0) returned 0x0
	[0256.121] WbemDefPath:IWbemPath:GetText (in: This=0xa22470, lFlags=8, puBuffLength=0x5d9ef58*=0xf, pszText="00000000000000" | out: puBuffLength=0x5d9ef58*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
	[0256.121] CoCreateInstance (in: rclsid=0x6cf23734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6cf23794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5d9ee08 | out: ppv=0x5d9ee08*=0xa76c30) returned 0x0
	[0256.121] WbemLocator:IWbemLocator:ConnectServer (in: This=0xa76c30, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5d9eea8 | out: ppNamespace=0x5d9eea8*=0x573e450) returned 0x0
	[0256.132] WbemLocator:IUnknown:QueryInterface (in: This=0x573e450, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5d9ed2c | out: ppvObject=0x5d9ed2c*=0xa5b6d4) returned 0x0
	[0256.132] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xa5b6d4, pProxy=0x573e450, pAuthnSvc=0x5d9ed7c, pAuthzSvc=0x5d9ed78, pServerPrincName=0x5d9ed70, pAuthnLevel=0x5d9ed74, pImpLevel=0x5d9ed64, pAuthInfo=0x5d9ed68, pCapabilites=0x5d9ed6c | out: pAuthnSvc=0x5d9ed7c*=0xa, pAuthzSvc=0x5d9ed78*=0x0, pServerPrincName=0x5d9ed70, pAuthnLevel=0x5d9ed74*=0x6, pImpLevel=0x5d9ed64*=0x2, pAuthInfo=0x5d9ed68, pCapabilites=0x5d9ed6c*=0x1) returned 0x0
	[0256.132] WbemLocator:IUnknown:Release (This=0xa5b6d4) returned 0x1
	[0256.132] WbemLocator:IUnknown:QueryInterface (in: This=0x573e450, riid=0x6cf235a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5d9ed20 | out: ppvObject=0x5d9ed20*=0xa5b6f4) returned 0x0
	[0256.132] WbemLocator:IUnknown:QueryInterface (in: This=0x573e450, riid=0x6cf235b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5d9ed0c | out: ppvObject=0x5d9ed0c*=0xa5b6d4) returned 0x0
	[0256.132] WbemLocator:IClientSecurity:SetBlanket (This=0xa5b6d4, pProxy=0x573e450, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
	[0256.132] WbemLocator:IUnknown:Release (This=0xa5b6d4) returned 0x2
	[0256.133] WbemLocator:IUnknown:Release (This=0xa5b6f4) returned 0x1
	[0256.133] CoTaskMemFree (pv=0x574def0) 
	[0256.133] WbemLocator:IUnknown:AddRef (This=0x573e450) returned 0x2
	[0256.133] WbemLocator:IUnknown:Release (This=0xa76c30) returned 0x0
	[0256.134] CoGetContextToken (in: pToken=0x5d9e260 | out: pToken=0x5d9e260) returned 0x0
	[0256.134] CoGetContextToken (in: pToken=0x5d9e674 | out: pToken=0x5d9e674) returned 0x0
	[0256.134] WbemLocator:IUnknown:QueryInterface (in: This=0x573e450, riid=0x724d1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5d9e60c | out: ppvObject=0x5d9e60c*=0xa5b6dc) returned 0x0
	[0256.134] WbemLocator:IRpcOptions:Query (in: This=0xa5b6dc, pPrx=0x574e858, dwProperty=2, pdwValue=0x5d9e700 | out: pdwValue=0x5d9e700) returned 0x80004002
	[0256.135] WbemLocator:IUnknown:Release (This=0xa5b6dc) returned 0x2
	[0256.135] CoGetContextToken (in: pToken=0x5d9ec44 | out: pToken=0x5d9ec44) returned 0x0
	[0256.135] CoGetContextToken (in: pToken=0x5d9eba4 | out: pToken=0x5d9eba4) returned 0x0
	[0256.135] WbemLocator:IUnknown:QueryInterface (in: This=0x573e450, riid=0x5d9ec74*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5d9eb40 | out: ppvObject=0x5d9eb40*=0x573e450) returned 0x0
	[0256.135] WbemLocator:IUnknown:Release (This=0x573e450) returned 0x2
	[0256.136] SysStringLen (param_1=0x0) returned 0x0
	[0256.136] CoUninitialize () 

Thread:
	id = 159
	os_tid = 0xdb0

	[0259.797] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0260.161] ResetEvent (hEvent=0x238) returned 1

Thread:
	id = 160
	os_tid = 0xdb8

	[0261.667] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0261.668] CoGetContextToken (in: pToken=0x608f084 | out: pToken=0x608f084) returned 0x0
	[0261.669] IUnknown:QueryInterface (in: This=0x9f1ea0, riid=0x7246b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x608f0a8 | out: ppvObject=0x608f0a8*=0x9f1eac) returned 0x0
	[0261.669] IComThreadingInfo:GetCurrentThreadType (in: This=0x9f1eac, pThreadType=0x608f0d4 | out: pThreadType=0x608f0d4*=0) returned 0x0
	[0261.669] IUnknown:Release (This=0x9f1eac) returned 0x1
	[0261.669] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
	[0261.669] CoUninitialize () 
	[0261.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x608ec6c | out: lpSystemTimeAsFileTime=0x608ec6c*(dwLowDateTime=0xa8c0e100, dwHighDateTime=0x1d7b3aa)) 
	[0261.671] GetLastInputInfo (in: plii=0x22323f8 | out: plii=0x22323f8*(cbSize=0x8, dwTime=0x180db87)) returned 1
	[0282.017] CoUninitialize () 

Thread:
	id = 161
	os_tid = 0xdac


Process:
	id = "8"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x78d28000"
	os_pid = "0x2c0"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "3"
	os_parent_pid = "0x1c0"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b805" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 2625
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2626
	        start_va = 0x20000
	          end_va = 0x20fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "svchost.exe.mui"
	        filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")

Region:
	              id = 2627
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2628
	        start_va = 0x40000
	          end_va = 0x40fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2629
	        start_va = 0x50000
	          end_va = 0x50fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 2630
	        start_va = 0x60000
	          end_va = 0x60fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2631
	        start_va = 0x70000
	          end_va = 0x71fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000070000"
	        filename = ""

Region:
	              id = 2632
	        start_va = 0x80000
	          end_va = 0x80fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000080000"
	        filename = ""

Region:
	              id = 2633
	        start_va = 0x90000
	          end_va = 0x10ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000090000"
	        filename = ""

Region:
	              id = 2634
	        start_va = 0x110000
	          end_va = 0x176fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2635
	        start_va = 0x180000
	          end_va = 0x1bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 2636
	        start_va = 0x1c0000
	          end_va = 0x1dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2637
	        start_va = 0x1e0000
	          end_va = 0x1ecfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "setupapi.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui")

Region:
	              id = 2638
	        start_va = 0x1f0000
	          end_va = 0x2effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2639
	        start_va = 0x2f0000
	          end_va = 0x3effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000002f0000"
	        filename = ""

Region:
	              id = 2640
	        start_va = 0x3f0000
	          end_va = 0x4affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000003f0000"
	        filename = ""

Region:
	              id = 2641
	        start_va = 0x4b0000
	          end_va = 0x4cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004b0000"
	        filename = ""

Region:
	              id = 2642
	        start_va = 0x4d0000
	          end_va = 0x4d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004d0000"
	        filename = ""

Region:
	              id = 2643
	        start_va = 0x4e0000
	          end_va = 0x4effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 2644
	        start_va = 0x4f0000
	          end_va = 0x677fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004f0000"
	        filename = ""

Region:
	              id = 2645
	        start_va = 0x680000
	          end_va = 0x800fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000680000"
	        filename = ""

Region:
	              id = 2646
	        start_va = 0x810000
	          end_va = 0x88ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000810000"
	        filename = ""

Region:
	              id = 2647
	        start_va = 0x890000
	          end_va = 0x890fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000890000"
	        filename = ""

Region:
	              id = 2648
	        start_va = 0x8a0000
	          end_va = 0x8a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008a0000"
	        filename = ""

Region:
	              id = 2649
	        start_va = 0x8b0000
	          end_va = 0x8b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008b0000"
	        filename = ""

Region:
	              id = 2650
	        start_va = 0x8c0000
	          end_va = 0x8c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008c0000"
	        filename = ""

Region:
	              id = 2651
	        start_va = 0x8d0000
	          end_va = 0x8effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008d0000"
	        filename = ""

Region:
	              id = 2652
	        start_va = 0x8f0000
	          end_va = 0x8f1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008f0000"
	        filename = ""

Region:
	              id = 2653
	        start_va = 0x900000
	          end_va = 0x907fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000900000"
	        filename = ""

Region:
	              id = 2654
	        start_va = 0x910000
	          end_va = 0x910fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000910000"
	        filename = ""

Region:
	              id = 2655
	        start_va = 0x920000
	          end_va = 0x920fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000920000"
	        filename = ""

Region:
	              id = 2656
	        start_va = 0x9b0000
	          end_va = 0xa2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000009b0000"
	        filename = ""

Region:
	              id = 2657
	        start_va = 0xa30000
	          end_va = 0xb2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000a30000"
	        filename = ""

Region:
	              id = 2658
	        start_va = 0xbe0000
	          end_va = 0xeaefff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2659
	        start_va = 0xef0000
	          end_va = 0xf6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ef0000"
	        filename = ""

Region:
	              id = 2660
	        start_va = 0xfd0000
	          end_va = 0x104ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000fd0000"
	        filename = ""

Region:
	              id = 2661
	        start_va = 0x1050000
	          end_va = 0x10cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001050000"
	        filename = ""

Region:
	              id = 2662
	        start_va = 0x10d0000
	          end_va = 0x1131fff
	       monitored = 0
	     entry_point = 0x10e08d8
	     region_type = mapped_file
	            name = "winlogon.exe"
	        filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe")

Region:
	              id = 2663
	        start_va = 0x1190000
	          end_va = 0x120ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001190000"
	        filename = ""

Region:
	              id = 2664
	        start_va = 0x1210000
	          end_va = 0x128ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001210000"
	        filename = ""

Region:
	              id = 2665
	        start_va = 0x12a0000
	          end_va = 0x139ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000012a0000"
	        filename = ""

Region:
	              id = 2666
	        start_va = 0x13c0000
	          end_va = 0x143ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000013c0000"
	        filename = ""

Region:
	              id = 2667
	        start_va = 0x1470000
	          end_va = 0x14effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001470000"
	        filename = ""

Region:
	              id = 2668
	        start_va = 0x1510000
	          end_va = 0x158ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001510000"
	        filename = ""

Region:
	              id = 2669
	        start_va = 0x15c0000
	          end_va = 0x163ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000015c0000"
	        filename = ""

Region:
	              id = 2670
	        start_va = 0x16a0000
	          end_va = 0x171ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000016a0000"
	        filename = ""

Region:
	              id = 2671
	        start_va = 0x1730000
	          end_va = 0x17affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001730000"
	        filename = ""

Region:
	              id = 2672
	        start_va = 0x1820000
	          end_va = 0x189ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001820000"
	        filename = ""

Region:
	              id = 2673
	        start_va = 0x18d0000
	          end_va = 0x194ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000018d0000"
	        filename = ""

Region:
	              id = 2674
	        start_va = 0x1950000
	          end_va = 0x19cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001950000"
	        filename = ""

Region:
	              id = 2675
	        start_va = 0x1a00000
	          end_va = 0x1a7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a00000"
	        filename = ""

Region:
	              id = 2676
	        start_va = 0x1a80000
	          end_va = 0x1c7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a80000"
	        filename = ""

Region:
	              id = 2677
	        start_va = 0x1d70000
	          end_va = 0x1deffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d70000"
	        filename = ""

Region:
	              id = 2678
	        start_va = 0x1e10000
	          end_va = 0x220ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001e10000"
	        filename = ""

Region:
	              id = 2679
	        start_va = 0x2280000
	          end_va = 0x22fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002280000"
	        filename = ""

Region:
	              id = 2680
	        start_va = 0x2300000
	          end_va = 0x2702fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002300000"
	        filename = ""

Region:
	              id = 2681
	        start_va = 0x27f0000
	          end_va = 0x286ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000027f0000"
	        filename = ""

Region:
	              id = 2682
	        start_va = 0x2880000
	          end_va = 0x28fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002880000"
	        filename = ""

Region:
	              id = 2683
	        start_va = 0x2900000
	          end_va = 0x297ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002900000"
	        filename = ""

Region:
	              id = 2684
	        start_va = 0x2980000
	          end_va = 0x29fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002980000"
	        filename = ""

Region:
	              id = 2685
	        start_va = 0x2a00000
	          end_va = 0x2afffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a00000"
	        filename = ""

Region:
	              id = 2686
	        start_va = 0x2b00000
	          end_va = 0x32fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b00000"
	        filename = ""

Region:
	              id = 2687
	        start_va = 0x774c0000
	          end_va = 0x775defff
	       monitored = 0
	     entry_point = 0x774d5340
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 2688
	        start_va = 0x775e0000
	          end_va = 0x776d9fff
	       monitored = 0
	     entry_point = 0x775fa2c8
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 2689
	        start_va = 0x776e0000
	          end_va = 0x77888fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2690
	        start_va = 0x7efe0000
	          end_va = 0x7f0dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007efe0000"
	        filename = ""

Region:
	              id = 2691
	        start_va = 0x7f0e0000
	          end_va = 0x7ffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007f0e0000"
	        filename = ""

Region:
	              id = 2692
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2693
	        start_va = 0xff280000
	          end_va = 0xff2e1fff
	       monitored = 0
	     entry_point = 0xff2908d8
	     region_type = mapped_file
	            name = "winlogon.exe"
	        filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe")

Region:
	              id = 2694
	        start_va = 0xff5b0000
	          end_va = 0xff602fff
	       monitored = 0
	     entry_point = 0xff5c3310
	     region_type = mapped_file
	            name = "services.exe"
	        filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe")

Region:
	              id = 2695
	        start_va = 0xff8c0000
	          end_va = 0xff8cafff
	       monitored = 0
	     entry_point = 0xff8c246c
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 2696
	        start_va = 0x7fef07c0000
	          end_va = 0x7fef086dfff
	       monitored = 0
	     entry_point = 0x7fef07c4104
	     region_type = mapped_file
	            name = "wuapi.dll"
	        filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll")

Region:
	              id = 2697
	        start_va = 0x7fef0870000
	          end_va = 0x7fef0994fff
	       monitored = 0
	     entry_point = 0x7fef08c1570
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll")

Region:
	              id = 2698
	        start_va = 0x7fef1270000
	          end_va = 0x7fef128bfff
	       monitored = 0
	     entry_point = 0x7fef1271060
	     region_type = mapped_file
	            name = "wscsvc.dll"
	        filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll")

Region:
	              id = 2699
	        start_va = 0x7fef5000000
	          end_va = 0x7fef5012fff
	       monitored = 0
	     entry_point = 0x7fef5001d80
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 2700
	        start_va = 0x7fef52e0000
	          end_va = 0x7fef52edfff
	       monitored = 0
	     entry_point = 0x7fef52e5500
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 2701
	        start_va = 0x7fef52f0000
	          end_va = 0x7fef5316fff
	       monitored = 0
	     entry_point = 0x7fef52f11a0
	     region_type = mapped_file
	            name = "ntdsapi.dll"
	        filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll")

Region:
	              id = 2702
	        start_va = 0x7fef5320000
	          end_va = 0x7fef53f2fff
	       monitored = 0
	     entry_point = 0x7fef5398b00
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 2703
	        start_va = 0x7fef55a0000
	          end_va = 0x7fef5616fff
	       monitored = 0
	     entry_point = 0x7fef55de7f0
	     region_type = mapped_file
	            name = "wbemcomn2.dll"
	        filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll")

Region:
	              id = 2704
	        start_va = 0x7fef7bd0000
	          end_va = 0x7fef7beafff
	       monitored = 0
	     entry_point = 0x7fef7bd1198
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 2705
	        start_va = 0x7fef8380000
	          end_va = 0x7fef83cefff
	       monitored = 0
	     entry_point = 0x7fef8382760
	     region_type = mapped_file
	            name = "audioses.dll"
	        filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll")

Region:
	              id = 2706
	        start_va = 0x7fefae70000
	          end_va = 0x7fefae87fff
	       monitored = 0
	     entry_point = 0x7fefae71bf8
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 2707
	        start_va = 0x7fefae90000
	          end_va = 0x7fefaea0fff
	       monitored = 0
	     entry_point = 0x7fefae916ac
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 2708
	        start_va = 0x7fefb010000
	          end_va = 0x7fefb04afff
	       monitored = 0
	     entry_point = 0x7fefb014520
	     region_type = mapped_file
	            name = "dhcpcore6.dll"
	        filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll")

Region:
	              id = 2709
	        start_va = 0x7fefb050000
	          end_va = 0x7fefb0a0fff
	       monitored = 0
	     entry_point = 0x7fefb05f6c0
	     region_type = mapped_file
	            name = "dhcpcore.dll"
	        filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll")

Region:
	              id = 2710
	        start_va = 0x7fefb0c0000
	          end_va = 0x7fefb0c7fff
	       monitored = 0
	     entry_point = 0x7fefb0c284c
	     region_type = mapped_file
	            name = "nrpsrv.dll"
	        filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll")

Region:
	              id = 2711
	        start_va = 0x7fefb0d0000
	          end_va = 0x7fefb0d9fff
	       monitored = 0
	     entry_point = 0x7fefb0d1adc
	     region_type = mapped_file
	            name = "lmhsvc.dll"
	        filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll")

Region:
	              id = 2712
	        start_va = 0x7fefb110000
	          end_va = 0x7fefb11afff
	       monitored = 0
	     entry_point = 0x7fefb111198
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 2713
	        start_va = 0x7fefb120000
	          end_va = 0x7fefb146fff
	       monitored = 0
	     entry_point = 0x7fefb1298bc
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 2714
	        start_va = 0x7fefb5c0000
	          end_va = 0x7fefb5c8fff
	       monitored = 0
	     entry_point = 0x7fefb5c1010
	     region_type = mapped_file
	            name = "avrt.dll"
	        filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll")

Region:
	              id = 2715
	        start_va = 0x7fefb5d0000
	          end_va = 0x7fefb5fbfff
	       monitored = 0
	     entry_point = 0x7fefb5d15c4
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 2716
	        start_va = 0x7fefb600000
	          end_va = 0x7fefb6abfff
	       monitored = 0
	     entry_point = 0x7fefb616acc
	     region_type = mapped_file
	            name = "audiosrv.dll"
	        filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll")

Region:
	              id = 2717
	        start_va = 0x7fefb6b0000
	          end_va = 0x7fefb6dcfff
	       monitored = 0
	     entry_point = 0x7fefb6b1010
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 2718
	        start_va = 0x7fefb850000
	          end_va = 0x7fefb864fff
	       monitored = 0
	     entry_point = 0x7fefb851050
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 2719
	        start_va = 0x7fefb870000
	          end_va = 0x7fefb87bfff
	       monitored = 0
	     entry_point = 0x7fefb8718a4
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 2720
	        start_va = 0x7fefbb70000
	          end_va = 0x7fefbbbafff
	       monitored = 0
	     entry_point = 0x7fefbb7efcc
	     region_type = mapped_file
	            name = "mmdevapi.dll"
	        filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll")

Region:
	              id = 2721
	        start_va = 0x7fefbfe0000
	          end_va = 0x7fefc10bfff
	       monitored = 0
	     entry_point = 0x7fefbfe94bc
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 2722
	        start_va = 0x7fefc650000
	          end_va = 0x7fefc7e5fff
	       monitored = 0
	     entry_point = 0x7fefc6578e4
	     region_type = mapped_file
	            name = "wevtsvc.dll"
	        filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll")

Region:
	              id = 2723
	        start_va = 0x7fefc7f0000
	          end_va = 0x7fefc7fbfff
	       monitored = 0
	     entry_point = 0x7fefc7f1064
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 2724
	        start_va = 0x7fefc800000
	          end_va = 0x7fefc8bafff
	       monitored = 0
	     entry_point = 0x7fefc806de0
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 2725
	        start_va = 0x7fefc8c0000
	          end_va = 0x7fefc8c6fff
	       monitored = 0
	     entry_point = 0x7fefc8c14b0
	     region_type = mapped_file
	            name = "wshtcpip.dll"
	        filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")

Region:
	              id = 2726
	        start_va = 0x7fefc9b0000
	          end_va = 0x7fefc9cafff
	       monitored = 0
	     entry_point = 0x7fefc9b2068
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 2727
	        start_va = 0x7fefc9d0000
	          end_va = 0x7fefc9edfff
	       monitored = 0
	     entry_point = 0x7fefc9d13b8
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 2728
	        start_va = 0x7fefcb20000
	          end_va = 0x7fefcb29fff
	       monitored = 0
	     entry_point = 0x7fefcb23cb8
	     region_type = mapped_file
	            name = "credssp.dll"
	        filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")

Region:
	              id = 2729
	        start_va = 0x7fefcc20000
	          end_va = 0x7fefcc66fff
	       monitored = 0
	     entry_point = 0x7fefcc21064
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 2730
	        start_va = 0x7fefcd40000
	          end_va = 0x7fefcd9afff
	       monitored = 0
	     entry_point = 0x7fefcd46940
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 2731
	        start_va = 0x7fefceb0000
	          end_va = 0x7fefceb6fff
	       monitored = 0
	     entry_point = 0x7fefceb142c
	     region_type = mapped_file
	            name = "wship6.dll"
	        filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")

Region:
	              id = 2732
	        start_va = 0x7fefcec0000
	          end_va = 0x7fefcf14fff
	       monitored = 0
	     entry_point = 0x7fefcec1054
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 2733
	        start_va = 0x7fefcf20000
	          end_va = 0x7fefcf37fff
	       monitored = 0
	     entry_point = 0x7fefcf23b48
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 2734
	        start_va = 0x7fefd090000
	          end_va = 0x7fefd0b1fff
	       monitored = 0
	     entry_point = 0x7fefd095d30
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 2735
	        start_va = 0x7fefd150000
	          end_va = 0x7fefd1bcfff
	       monitored = 0
	     entry_point = 0x7fefd151010
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 2736
	        start_va = 0x7fefd4c0000
	          end_va = 0x7fefd4cafff
	       monitored = 0
	     entry_point = 0x7fefd4c1030
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 2737
	        start_va = 0x7fefd4f0000
	          end_va = 0x7fefd514fff
	       monitored = 0
	     entry_point = 0x7fefd4f9658
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 2738
	        start_va = 0x7fefd520000
	          end_va = 0x7fefd52efff
	       monitored = 0
	     entry_point = 0x7fefd521010
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 2739
	        start_va = 0x7fefd5d0000
	          end_va = 0x7fefd60cfff
	       monitored = 0
	     entry_point = 0x7fefd5d18f4
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 2740
	        start_va = 0x7fefd610000
	          end_va = 0x7fefd623fff
	       monitored = 0
	     entry_point = 0x7fefd6110e0
	     region_type = mapped_file
	            name = "rpcrtremote.dll"
	        filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")

Region:
	              id = 2741
	        start_va = 0x7fefd630000
	          end_va = 0x7fefd63efff
	       monitored = 0
	     entry_point = 0x7fefd6319b0
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 2742
	        start_va = 0x7fefd6d0000
	          end_va = 0x7fefd6defff
	       monitored = 0
	     entry_point = 0x7fefd6d1020
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 2743
	        start_va = 0x7fefd6e0000
	          end_va = 0x7fefd6f9fff
	       monitored = 0
	     entry_point = 0x7fefd6e1558
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 2744
	        start_va = 0x7fefd700000
	          end_va = 0x7fefd735fff
	       monitored = 0
	     entry_point = 0x7fefd701474
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 2745
	        start_va = 0x7fefd7e0000
	          end_va = 0x7fefd84bfff
	       monitored = 0
	     entry_point = 0x7fefd7e2780
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 2746
	        start_va = 0x7fefd850000
	          end_va = 0x7fefd9bcfff
	       monitored = 0
	     entry_point = 0x7fefd8510b4
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 2747
	        start_va = 0x7fefd9c0000
	          end_va = 0x7fefd9fafff
	       monitored = 0
	     entry_point = 0x7fefd9c1324
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 2748
	        start_va = 0x7fefda00000
	          end_va = 0x7fefdb2cfff
	       monitored = 0
	     entry_point = 0x7fefda4ed50
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 2749
	        start_va = 0x7fefdb30000
	          end_va = 0x7fefdbf8fff
	       monitored = 0
	     entry_point = 0x7fefdbaa874
	     region_type = mapped_file
	            name = "usp10.dll"
	        filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")

Region:
	              id = 2750
	        start_va = 0x7fefdc00000
	          end_va = 0x7fefdc0dfff
	       monitored = 0
	     entry_point = 0x7fefdc01080
	     region_type = mapped_file
	            name = "lpk.dll"
	        filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")

Region:
	              id = 2751
	        start_va = 0x7fefdc10000
	          end_va = 0x7fefdc17fff
	       monitored = 0
	     entry_point = 0x7fefdc11504
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 2752
	        start_va = 0x7fefdc20000
	          end_va = 0x7fefdc90fff
	       monitored = 0
	     entry_point = 0x7fefdc31e20
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 2753
	        start_va = 0x7fefdca0000
	          end_va = 0x7fefdd06fff
	       monitored = 0
	     entry_point = 0x7fefdcab03c
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 2754
	        start_va = 0x7fefdd10000
	          end_va = 0x7fefdd5cfff
	       monitored = 0
	     entry_point = 0x7fefdd11070
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 2755
	        start_va = 0x7fefdd60000
	          end_va = 0x7fefdd7efff
	       monitored = 0
	     entry_point = 0x7fefdd660e8
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 2756
	        start_va = 0x7fefdd80000
	          end_va = 0x7fefdf82fff
	       monitored = 0
	     entry_point = 0x7fefdda3330
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 2757
	        start_va = 0x7fefdf90000
	          end_va = 0x7fefdfe1fff
	       monitored = 0
	     entry_point = 0x7fefdf910d4
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 2758
	        start_va = 0x7fefdff0000
	          end_va = 0x7fefe01dfff
	       monitored = 0
	     entry_point = 0x7fefdff1010
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 2759
	        start_va = 0x7fefe020000
	          end_va = 0x7fefe0fafff
	       monitored = 0
	     entry_point = 0x7fefe040760
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 2760
	        start_va = 0x7fefe280000
	          end_va = 0x7fefe456fff
	       monitored = 0
	     entry_point = 0x7fefe281010
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 2761
	        start_va = 0x7fefe4e0000
	          end_va = 0x7fefe5e8fff
	       monitored = 0
	     entry_point = 0x7fefe4e1064
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 2762
	        start_va = 0x7fefe850000
	          end_va = 0x7fefe8e8fff
	       monitored = 0
	     entry_point = 0x7fefe851c10
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 2763
	        start_va = 0x7fefe8f0000
	          end_va = 0x7fefe9c6fff
	       monitored = 0
	     entry_point = 0x7fefe8f3274
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 2764
	        start_va = 0x7feff930000
	          end_va = 0x7feff9cefff
	       monitored = 0
	     entry_point = 0x7feff9325a0
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 2765
	        start_va = 0x7feffa00000
	          end_va = 0x7feffa00fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "apisetschema.dll"
	        filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")

Region:
	              id = 2766
	        start_va = 0x7fffff8a000
	          end_va = 0x7fffff8bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8a000"
	        filename = ""

Region:
	              id = 2767
	        start_va = 0x7fffff8c000
	          end_va = 0x7fffff8dfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff8c000"
	        filename = ""

Region:
	              id = 2768
	        start_va = 0x7fffff90000
	          end_va = 0x7fffff91fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff90000"
	        filename = ""

Region:
	              id = 2769
	        start_va = 0x7fffff92000
	          end_va = 0x7fffff93fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff92000"
	        filename = ""

Region:
	              id = 2770
	        start_va = 0x7fffff94000
	          end_va = 0x7fffff95fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff94000"
	        filename = ""

Region:
	              id = 2771
	        start_va = 0x7fffff98000
	          end_va = 0x7fffff99fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff98000"
	        filename = ""

Region:
	              id = 2772
	        start_va = 0x7fffff9a000
	          end_va = 0x7fffff9bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9a000"
	        filename = ""

Region:
	              id = 2773
	        start_va = 0x7fffff9c000
	          end_va = 0x7fffff9dfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9c000"
	        filename = ""

Region:
	              id = 2774
	        start_va = 0x7fffff9e000
	          end_va = 0x7fffff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffff9e000"
	        filename = ""

Region:
	              id = 2775
	        start_va = 0x7fffffa0000
	          end_va = 0x7fffffa1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa0000"
	        filename = ""

Region:
	              id = 2776
	        start_va = 0x7fffffa2000
	          end_va = 0x7fffffa3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa2000"
	        filename = ""

Region:
	              id = 2777
	        start_va = 0x7fffffa4000
	          end_va = 0x7fffffa5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa4000"
	        filename = ""

Region:
	              id = 2778
	        start_va = 0x7fffffa6000
	          end_va = 0x7fffffa7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa6000"
	        filename = ""

Region:
	              id = 2779
	        start_va = 0x7fffffa8000
	          end_va = 0x7fffffa9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffa8000"
	        filename = ""

Region:
	              id = 2780
	        start_va = 0x7fffffaa000
	          end_va = 0x7fffffabfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffaa000"
	        filename = ""

Region:
	              id = 2781
	        start_va = 0x7fffffac000
	          end_va = 0x7fffffadfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffac000"
	        filename = ""

Region:
	              id = 2782
	        start_va = 0x7fffffae000
	          end_va = 0x7fffffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffae000"
	        filename = ""

Region:
	              id = 2783
	        start_va = 0x7fffffb0000
	          end_va = 0x7fffffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000007fffffb0000"
	        filename = ""

Region:
	              id = 2784
	        start_va = 0x7fffffd4000
	          end_va = 0x7fffffd5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd4000"
	        filename = ""

Region:
	              id = 2785
	        start_va = 0x7fffffd6000
	          end_va = 0x7fffffd7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd6000"
	        filename = ""

Region:
	              id = 2786
	        start_va = 0x7fffffd8000
	          end_va = 0x7fffffd9fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffd8000"
	        filename = ""

Region:
	              id = 2787
	        start_va = 0x7fffffda000
	          end_va = 0x7fffffdbfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffda000"
	        filename = ""

Region:
	              id = 2788
	        start_va = 0x7fffffdc000
	          end_va = 0x7fffffdcfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffdc000"
	        filename = ""

Region:
	              id = 2789
	        start_va = 0x7fffffde000
	          end_va = 0x7fffffdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000007fffffde000"
	        filename = ""

Region:
	              id = 2810
	        start_va = 0x7fef2330000
	          end_va = 0x7fef24affff
	       monitored = 0
	     entry_point = 0x7fef23680d0
	     region_type = mapped_file
	            name = "racengn.dll"
	        filename = "\\Windows\\System32\\RacEngn.dll" (normalized: "c:\\windows\\system32\\racengn.dll")


Thread:
	id = 115
	os_tid = 0xaf4


Thread:
	id = 116
	os_tid = 0xa98


Thread:
	id = 117
	os_tid = 0xd70


Thread:
	id = 118
	os_tid = 0xd6c


Thread:
	id = 119
	os_tid = 0x780


Thread:
	id = 120
	os_tid = 0x698


Thread:
	id = 121
	os_tid = 0x12c


Thread:
	id = 122
	os_tid = 0x7f8


Thread:
	id = 123
	os_tid = 0x5dc


Thread:
	id = 124
	os_tid = 0x5c8


Thread:
	id = 125
	os_tid = 0x5c0


Thread:
	id = 126
	os_tid = 0x574


Thread:
	id = 127
	os_tid = 0x570


Thread:
	id = 128
	os_tid = 0x128


Thread:
	id = 129
	os_tid = 0x13c


Thread:
	id = 130
	os_tid = 0x3b0


Thread:
	id = 131
	os_tid = 0x3ac


Thread:
	id = 132
	os_tid = 0x39c


Thread:
	id = 133
	os_tid = 0x30c


Thread:
	id = 134
	os_tid = 0x2fc


Thread:
	id = 135
	os_tid = 0x2cc


Thread:
	id = 136
	os_tid = 0x2c4


Thread:
	id = 137
	os_tid = 0xd3c


Thread:
	id = 145
	os_tid = 0xd8c